Fast Evaluation Of Many Polynomials With Small Coefficients On The Same Point

ABSTRACT

In one exemplary embodiment of the invention, a method for evaluating at point r one or more polynomials p 1 (x), . . . , p l (x) of maximum degree up to n−1, where the polynomial p i (x) has a degree of t i −1, the method including: partitioning each polynomial p i (x) into a bottom half p i   bot (x) with bottom terms of lowest s i  coefficients and a top half p i   top (x) with top terms of remaining t i −s i  coefficients; recursively partitioning the bottom half p i   bot (x) and the top half p i   top (x) of each polynomial p i (x) obtaining further terms having a lower degree than previous terms, performed until at least one condition is met yielding a plurality of partitioned terms; evaluating the bottom half p i   bot (x) and the top half p i   top (x) at the point r for each polynomial p i (x) by evaluating the partitioned terms at the point r and iteratively combining the evaluated partitioned terms; and evaluating each polynomial p i (x) at the point r by setting p i (r)=r s     i   p i   top (r)+p i   bot (r).

CROSS-REFERENCE TO RELATED APPLICATIONS

This patent application claims priority under 35 U.S.C. §119(e) fromU.S. Provisional Patent Application No. 61/374,152, filed Aug. 16, 2010,the disclosure of which is incorporated by reference herein in itsentirety.

TECHNICAL FIELD

The exemplary embodiments of this invention relate generally toencryption and decryption and, more specifically, relate to variousencryption and decryption techniques that may be particularly applicablefor homomorphic encryption.

BACKGROUND

This section endeavors to supply a context or background for the variousexemplary embodiments of the invention as recited in the claims. Thecontent herein may comprise subject matter that could be utilized, butnot necessarily matter that has been previously utilized, described orconsidered. Unless indicated otherwise, the content described herein isnot considered prior art, and should not be considered as admitted priorart by inclusion in this section.

Encryption schemes that support operations on encrypted data (akahomomorphic encryption) have a very wide range of applications incryptography. This concept was introduced by Rivest et al. shortly afterthe discovery of public key cryptography [13], and many known public-keycryptosystems support either addition or multiplication of encrypteddata. However, supporting both at the same time seems harder, and untilvery recently attempts at constructing so-called “fully homomorphic”encryption turned out to be insecure.

BRIEF SUMMARY

In one exemplary embodiment of the invention, a method for evaluating ata point r one or more polynomials p₁(x), . . . , p_(l)(x) of maximumdegree up to n−1, where for every i the polynomial p_(i)(x) has a degreeof exactly t_(i)−1, the method comprising: partitioning each polynomialp_(i)(x) into a bottom half p_(i) ^(bot)(x) consisting of bottom termswith lowest s_(i) coefficients and a top half p_(i) ^(top)(x) consistingof top terms with remaining t_(i)−s_(i) coefficients, where n and l areintegers greater than zero, where for every i, t_(i) and s_(i) areintegers greater than zero; recursively partitioning the bottom halfp_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms; evaluating the bottom half p_(i)^(bot)(x) and the top half p_(i) ^(top)(x) at the point r for eachpolynomial p_(i)(x) by evaluating the plurality of partitioned terms atthe point r and iteratively combining the evaluated partitioned terms;and evaluating each polynomial p_(i)(x) at the point r by settingp_(i)(r)=r^(s) ^(i) p_(i) ^(top)(r)+p_(i) ^(bot)(r).

In another exemplary embodiment of the invention, a method forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, where for every i the polynomial p_(i)(x)has a degree of exactly t_(i)−1, comprising: partitioning eachpolynomial p_(i)(x) into a_(i) parts p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . ,p_(i) ^((a) ^(i)) (x), where for each i and j the part p_(i) ^((j))(x)consists of a different sequential portion of the t_(i) coefficients ofthe polynomial p_(i)(x), where n is an integer greater than zero, wherefor every i, a_(i), and t_(i) are integers greater than zero;recursively partitioning each part p_(i) ^((j))(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms; evaluating each part p_(i) ^((j))(x) atthe point r for each polynomial p_(i)(x) by evaluating the plurality ofpartitioned terms at the point r and iteratively combining the evaluatedpartitioned terms; and evaluating each polynomial p_(i)(x) at the pointr by setting p_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y) ^(ij) p_(i) ^((j))(r),where for every i, y_(ij) is a total number of coefficients in all ofthe parts from 1 to j−1: p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . , p_(i)^((j−1))(x).

In a further exemplary embodiment of the invention, a method forevaluating at a point one or more polynomials, comprising: starting witha current number of current polynomials having a current maximal degree,recursively partitioning the current polynomials to double the currentnumber of current polynomials while reducing the current maximal degreeof the current polynomials by half; in response to the current maximaldegree meeting at least one condition, evaluating the currentpolynomials to obtain a plurality of partial results and obtaining atotal evaluation for the one or more polynomials at the point byrecombining the plurality of partial results into polynomials in reverseorder from the recursive partitioning.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The foregoing and other aspects of the exemplary embodiments of thisinvention are made more evident in the following Detailed Description,when read in conjunction with the attached Drawing Figures, wherein:

FIG. 1 illustrates a block diagram of an exemplary system in whichvarious exemplary embodiments of the invention may be implemented;

FIG. 2 depicts a logic flow diagram illustrative of the operation of anexemplary method, and the operation of an exemplary computer program, inaccordance with the exemplary embodiments of this invention;

FIG. 3 depicts a logic flow diagram illustrative of the operation of anexemplary method, and the operation of an exemplary computer program, inaccordance with the exemplary embodiments of this invention;

FIG. 4 depicts a logic flow diagram illustrative of the operation ofanother exemplary method, and the operation of an exemplary computerprogram, in accordance with the exemplary embodiments of this invention;

FIG. 5 depicts a logic flow diagram illustrative of the operation of afurther exemplary method, and the operation of an exemplary computerprogram, in accordance with the exemplary embodiments of this invention;

FIG. 6 shows a table with an example for implementing various exemplaryembodiments of the invention;

FIG. 7 depicts a logic flow diagram illustrative of the operation ofanother exemplary method, and the operation of an exemplary computerprogram, in accordance with the exemplary embodiments of this invention;and

FIG. 8 depicts a logic flow diagram illustrative of the operation of afurther exemplary method, and the operation of an exemplary computerprogram, in accordance with the exemplary embodiments of this invention.

DETAILED DESCRIPTION

1 Introduction

In 2009, Gentry described the first plausible construction of a fullyhomomorphic cryptosystem [3]. Gentry's construction consists of severalsteps: He first constructed a “somewhat homomorphic” scheme thatsupports evaluating low-degree polynomials on the encrypted data, nexthe needed to “squash” the decryption procedure so that it can beexpressed as a low-degree polynomial which is supported by the scheme,and finally he applied a “bootstrapping” transformation to obtain afully homomorphic scheme. The crucial point in this process is to obtaina scheme that can evaluate polynomials of high-enough degree, and at thesame time has decryption procedure that can be expressed as a polynomialof low-enough degree. Once the degree of polynomials that can beevaluated by the scheme exceeds the degree of the decryption polynomial(times two), the scheme is called “bootstrappable” and it can then beconverted into a fully homomorphic scheme.

Towards a bootstrappable scheme, Gentry described in [3] a somewhathomomorphic scheme, which is roughly a GGH-type scheme [6, 8] over ideallattices. Gentry later proved [4] that with an appropriatekey-generation procedure, the security of that scheme can be (quantumly)reduced to the worst-case hardness of some problems in ideal lattices.

This somewhat homomorphic scheme is not yet bootstrappable, so Gentrydescribed in [3]a transformation to squash the decryption procedure,reducing the degree of the decryption polynomial. This is done by addingto the public key an additional hint about the secret key, in the formof a “sparse subset-sum” problem (SSSP). Namely the public key isaugmented with a big set of vectors, such that there exists a verysparse subset of them that adds up to the secret key. A ciphertext ofthe underlying scheme can be “post-processed” using this additionalhint, and the post-processed ciphertext can be decrypted with alow-degree polynomial, thus obtaining a bootstrappable scheme.

Stehlé and Steinfeld described in [14] two optimizations to Gentry'sscheme, one that reduces the number of vectors in the SSSP instance, andanother that can be used to reduce the degree of the decryptionpolynomial (at the expense of introducing a small probability ofdecryption errors). In exemplary embodiments of the instantimplementation, the first optimization is used but not the second. Thereason for not using the second optimization is that the decryptionerror probability is too high for the parameter settings. Someimprovements to Gentry's key-generation procedure were discussed in [9].

1.1 The Smart-Vercauteren Implementation

The first attempt to implement Gentry's scheme was made in 2010 by Smartand Vercauteren [13]. They chose to implement a variant of the schemeusing “principal-ideal lattices” of prime determinant. Such lattices canbe represented implicitly by just two integers (regardless of theirdimension), and moreover Smart and Vercauteren described a decryptionmethod where the secret key is represented by a single integer. Smartand Vercauteren were able to implement the underlying somewhathomomorphic scheme, but they were not able to support large enoughparameters to make Gentry's squashing technique go through. As a resultthey could not obtain a bootstrappable scheme or a fully homomorphicscheme.

One obstacle in the Smart-Vercauteren implementation was the complexityof key generation for the somewhat homomorphic scheme: For one thing,they must generate many candidates before they find one whosedeterminant is prime. (One may need to try as many as n^(1.5) candidateswhen working with lattices in dimension n.) And even after finding one,the complexity of computing the secret key that corresponds to thislattice is at least {tilde over (Θ)}(n^(2.5)) for lattices in dimensionn. For both of these reasons, they were not able to generate keys indimensions n>2048.

Moreover, Smart and Vercauteren estimated that the squashed decryptionpolynomial will have degree of a few hundreds, and that to support thisprocedure with their parameters they need to use lattices of dimensionat least n=2²⁷ (≈1.3×10⁸), which is well beyond the capabilities of thekey-generation procedure.

1.2 This Implementation

Exemplary embodiments for the instant implementation continue in thesame direction of the Smart-Vercauteren implementation and describeoptimizations that allow for also implementing the squashing part,thereby obtaining a bootstrappable scheme and a fully homomorphicscheme.

For key-generation, a faster algorithm is presented for computing thesecret key, and also eliminates the requirement that the determinant ofthe lattice be prime. Also presented are many simplifications andoptimizations for the squashed decryption procedure, and as a result thedecryption polynomial has degree only fifteen. Finally, the choice ofparameters is somewhat more aggressive than Smart and Vercauteren (whichis complemented herein by analyzing the complexity of known attacks).

Differently from [13], the dimension n is decoupled from the size of theintegers that are chosen during key generation. The latter parameter isdenoted t herein. It is the logarithm of the parameter η in [13].Decoupling these two parameters allows for decoupling functionality fromsecurity. Namely, one can obtain bootstrappable schemes in any givendimension, but of course the schemes in low dimensions will not besecure. The analysis suggests that the scheme may be practically secureat dimension n=2¹³ or n=2¹⁵, and this analysis is put to the test bypublishing a few challenges in dimensions ranging from 512 up to 2¹⁵.

Various exemplary embodiments of the invention describe workingimplementations of a variant of Gentry's fully homomorphic encryptionscheme (STOC 2009), similar to the variant used in an earlierimplementation effort by Smart and Vercauteren (PKC 2010). Smart andVercauteren implemented the underlying “somewhat homomorphic” scheme,but were not able to implement the bootstrapping functionality that isneeded to get the complete scheme to work. It is shown that a number ofoptimizations allow for the implementation all aspects of the scheme,including the bootstrapping functionality.

One of the optimizations is a key-generation method for the underlyingsomewhat homomorphic encryption, that does not require full polynomialinversion. This reduces the asymptotic complexity from Õ(n^(2.5)) toÕ(n^(1.5)) when working with dimension-n lattices (and practicallyreducing the time from many hours/days to a few seconds/minutes). Othernon-limiting examples of optimizations include a batching technique forencryption, a careful analysis of the degree of the decryptionpolynomial, and some space/time trade-offs for the fully-homomorphicscheme.

Exemplary embodiments of the implementation are tested with lattices ofseveral dimensions, corresponding to several security levels. From a“toy” setting in dimension 512, to “small,” “medium,” and “large”settings in dimensions 2048, 8192, and 32768, respectively. Thepublic-key size ranges in size from 70 Megabytes for the “small” settingto 2.3 Gigabytes for the “large” setting. The time to run onebootstrapping operation (on a 1-CPU 64-bit machine with large memory)ranges from 30 seconds for the “small” setting to 30 minutes for the“large” setting.

1.3 Organization

To aid reading, listed here are examples of the optimizations that aredescribed in this report, with pointers to the sections where they arepresented.

Somewhat-Homomorphic Scheme.

-   -   1. Replace the Smart-Vercauteren requirement [13] that the        lattice has prime determinant, by the much weaker requirement        that the Hermite normal form (HNF) of the lattice has a        particular form, as explained in Step 3 of Section 3. Also        provided is a simple criterion for checking for this special        form.    -   2. Decrypt using a single coefficient of the secret inverse        polynomial (similarly to Smart-Vercauteren [13]), but for        convenience use modular arithmetic rather than rational        division. See Section 6.1.    -   3. Use a highly optimized algorithm for computing the resultant        and one coefficient of the inverse of a given polynomial v(x)        with respect to f(x)=x² ^(m) ±1 (without having to compute the        entire inverse). See Section 4.    -   4. Use batch techniques to speed-up encryption. Specifically,        use an efficient algorithm for batch evaluation of many        polynomials with small coefficients on the same point. See        Section 5. The algorithm, when specialized to evaluating a        single polynomial, is essentially the same as Avanzi's trick        [1], which itself is similar to the algorithm of Paterson and        Stockmeyer [10]. The time to evaluate k polynomials is only        O(√{square root over (k)}) more than evaluating a single        polynomial.

Fully Homomorphic Scheme.

-   -   5. The secret key in this implementation is a binary vector of        length S≈1000, with only s=15 bits set to one, and the others        set to zero. Significant speedup is obtained by representing the        secret key in s groups of S bits each, such that each group has        a single 1-bit in it. See Section 8.1.    -   6. The public key of the bootstrappable scheme contains an        instance of the sparse-subset-sum problem, and instances are        used that have a very space-efficient representation.        Specifically, the instances are derived from geometric        progressions. See Section 9.1.    -   7. Similarly, the public key of the fully homomorphic scheme        contains an encryption of all the secret-key bits, and a        space-time tradeoff is used to optimize the space that it takes        to store all these ciphertexts without paying too much in        running time. See Section 9.2.

Finally, the choice of parameters is presented in Section 10, and someperformance numbers are given in Section 11. Throughout the text moreemphasis is placed on concrete parameters than on asymptotics—asymptoticbounds can be found in [14].

2 Background

Notations.

Throughout this report ‘·’ is used to denote scalar multiplication and‘×’ to denote any other type of multiplication. For integers z, d,denote the reduction of z modulo d by either [z]_(d) or

z

_(d). Use [z]_(d) when the operation maps integers to the interval[−d/2, d/2), and use

z

_(d) when the operation maps integers to the interval [0, d). Use thegeneric “z mod d” when the specific interval does not matter (e.g., mod2). For example, [13]₅=−2 vs.

13

₅=3, but [9]₇=

9

₇=2.

For a rational number q, denote by ┌q┘ the rounding of q to the nearestinteger, and by [q] denote the distance between q and the nearestinteger. That is, if

$q = \frac{a}{b}$

then

$\lbrack q\rbrack \overset{def}{=}{{\frac{\lbrack a\rbrack_{b}}{b}\mspace{14mu} {and}\mspace{14mu} \left\lceil q \right\rfloor}\overset{def}{=}{q - {\lbrack q\rbrack.}}}$

For example,

$\left\lceil \frac{13}{5} \right\rfloor = {{3\mspace{14mu} {{and}\mspace{14mu}\left\lbrack \frac{13}{5} \right\rbrack}} = {\frac{- 2}{5}.}}$

These notations are extended to vectors in the natural way: for exampleif {right arrow over (q)}=

q₀, q₁, . . . , q_(n−1)

is a rational vector then rounding is done coordinate-wise, ┌{rightarrow over (q)}┘=

┌q₀┘, ┌q₁┘, . . . , ┌q_(n−1)┘

.

2.1 Lattices

A full-rank n-dimensional lattice is a discrete subgroup of R^(n) (i.e.,

^(n), an n-dimensional vector space over the set of real numbers),concretely represented as the set of all integer linear combinations ofsome basis B=({right arrow over (b)}₁, . . . , {right arrow over(b)}_(n))εR^(n) of linearly independent vectors. Viewing the vectors{right arrow over (b)}_(i) as the rows of a matrix BεR^(n×n), one has:L=L(B)={{right arrow over (y)}×B:{right arrow over (y)}εZ^(n)}, whereZ^(n) is

n (an n-dimensional vector space over the set of integers).

Every lattice of dimension n>1 has an infinite number of lattice bases.If B₁ and B₂ are two lattice bases of lattice L, then there is someunimodular matrix U (i.e., U has integer entries and det(U)=±1)satisfying B₁=U×B₂. Since U is unimodular, |det(B_(i))| is invariant fordifferent bases of L. Since it is invariant, one may refer to det(L).This value is precisely the size of the quotient group Z^(n)/L if L isan integer lattice. To basis B of lattice L one associates the half-openparallelepiped P(B)←{Σ_(i=1) ^(n)x_(i){right arrow over(b)}_(i):x_(i)ε[−½,½)}. The volume of P(B) is precisely det(L).

For {right arrow over (c)}εR^(n) and basis B of lattice L, use {rightarrow over (c)} mod B to denote the unique vector {right arrow over(c)}εP(B) such that {right arrow over (c)}−{right arrow over (c)}′εL.Given {right arrow over (c)} and B, {right arrow over (c)} mod B can becomputed efficiently as {right arrow over (c)}−┌{right arrow over(c)}×B⁻¹┘×B=[{right arrow over (c)}×B⁻¹]×B. (Recall that ┌·┘ meansrounding to the nearest integer and [·] is the fractional part.)

Every rational full-rank lattice has a unique Hermite normal form (HNF)basis where b_(i,j)=0 for all i<j (lower-triangular), b_(j,j)>0 for allj, and b_(j,j)ε[−b_(i,j)/2,+b_(i,j)/2) for all i>j. Given any basis B ofL, one can compute HNF(L) efficiently via Gaussian elimination. The HNFis in some sense the “least revealing” basis of L, and thus typicallyserves as the public key representation of the lattice [8].

Short Vectors and Bounded Distance Decoding.

The length of the shortest nonzero vector in a lattice L is denotedλ₁(L), and Minkowski's theorem says that for any n-dimensional lattice Lone has λ₁(L)≦√{square root over (n)}·det(L)^(1/n). Heuristically, forrandom lattices the quantity det(L)^(1/n) serves as a threshold: fort<<det(L)^(1/n) one does not expect to find any nonzero vectors in L ofsize t, but for t>>det(L)^(1/n) one expects to find exponentially manyvectors in L of size t.

In the “bounded distance decoding” problem (BDDP), one is given a basisB of some lattice L, and a vector {right arrow over (c)} that is veryclose to some lattice point of L, and the goal is to find the point in Lnearest to {right arrow over (c)}. In the promise problem γ-BDDP, onehas a parameter γ>1 and the promise that

${{dist}\left( {L,\overset{\rightarrow}{c}} \right)}\overset{def}{=}{{\min_{\overset{\rightarrow}{v} \in L}\left\{ {{\overset{\rightarrow}{c} - \overset{\rightarrow}{v}}} \right\}} \leq {{\det (L)}^{1/n}/{\gamma.}}}$

(BDDP is often defined with respect to λ₁ rather than with respect todet(L)^(1/n), but the current definition is more convenient in theinstant case.)

Gama and Nguyen conducted extensive experiments with lattices indimensions 100-400 [2], and concluded that for those dimensions it isfeasible to solve γ-BDDP when γ>1.01^(n)≈2^(n/70). More generally, thebest algorithms for solving the γ-BDDP in n-dimensional lattices takestime exponential in n/log γ. Specifically, in time 2^(k) currently knownalgorithms can solve γ-BDDP in dimension n up to

${\gamma = 2^{\frac{\mu \; n}{k/{logk}}}},$

where μ is a parameter that depends on the exact details of thealgorithm. (Extrapolating from the Gama-Nguyen experiments, one mayexpect something like με[0.1,0.2].)

2.2 Ideal Lattices

Let f(x) be an integer monic irreducible polynomial of degree n. In thispaper, f(x)=x^(n)+1 is used, where n is a power of 2. Let R be the ringof integer polynomials modulo f(x),

$R\overset{def}{=}{{Z\lbrack x\rbrack}/{\left( {f(x)} \right).}}$

Each element of R is a polynomial of degree n−1, and thus is associatedto a coefficient vector in Z^(n). In this way, one can view each elementof R as being both a polynomial and a vector. For {right arrow over(v)}(x), let ∥{right arrow over (v)}∥ be the Euclidean norm of itscoefficient vector. For every ring R, there is an associated expansionfactor γ_(Mult)(R) such that ∥{right arrow over (u)}×{right arrow over(v)}∥≦γ_(Mult)(R)·∥{right arrow over (u)}∥·∥{right arrow over (v)}∥,where × denotes multiplication in the ring. When f(x)=x^(n)+1,γ_(Mult)(R) is √{square root over (n)}. However, for “random vectors”{right arrow over (u)}, {right arrow over (v)} the expansion factor istypically much smaller, and experiments suggest that one typically has∥{right arrow over (u)}×{right arrow over (v)}∥≈∥{right arrow over(u)}∥·∥{right arrow over (v)}∥.

Let I be an ideal of R—that is, a subset of R that is closed underaddition and multiplication by elements of R. Since I is additivelyclosed, the coefficient vectors associated to elements of I form alattice. Call I an ideal lattice to emphasize this object's dual natureas an algebraic ideal and a lattice. Alternative representations of anideal lattice are possible—e.g., see [11, 7]. Ideals have additivestructure as lattices, but they also have multiplicative structure. Theproduct IJ of two ideals I and J is the additive closure of the set{{right arrow over (v)}×{right arrow over (w)}:{right arrow over (v)}εI,{right arrow over (w)}εJ}, where ‘×’ is ring multiplication. To simplifythings, principal ideals of R will be used—i.e., ideals with a singlegenerator. The ideal ({right arrow over (v)}) generated by {right arrowover (v)}εR corresponds to the lattice generated by the vectors

$\left\{ {{\overset{->}{v}}_{i}\overset{def}{=}{{\overset{->}{v} \times x^{i}{mod}\; {f(x)}}:{i \in \left\lbrack {0,{n - 1}} \right\rbrack}}} \right\};$

call this the rotation basis of the ideal lattice ({right arrow over(v)}).

Let K be a field containing the ring R (in the instant caseK=Q[x]/(f(x))). The inverse of an ideal I

R is I⁻¹={{right arrow over (w)}εK:∀{right arrow over (v)}εI,{rightarrow over (v)}×{right arrow over (w)}εR}. The inverse of a principalideal ({right arrow over (v)}) is given by ({right arrow over (v)}⁻¹),where the inverse {right arrow over (v)}⁻¹ is taken in the field K.

2.3 GGH-Type Cryptosystems

Briefly recall Micciancio's “cleaned-up version” of GGH cryptosystems[6, 8]. The secret and public keys are “good” and “bad” bases of somelattice L. More specifically, the key-holder generates a good basis bychoosing B_(sk) to be a basis of short, “nearly orthogonal” vectors.Then it sets the public key to be the Hermite normal form of the samelattice,

$B_{p\; k}\overset{def}{=}{H\; N\; {{F\left( {L\left( B_{sk} \right)} \right)}.}}$

A ciphertext in a GGH-type cryptosystem is a vector {right arrow over(c)} close to the lattice L(B_(pk)), and the message which is encryptedin this ciphertext is somehow embedded in the distance from {right arrowover (c)} to the nearest lattice vector. To encrypt a message m, thesender chooses a short “error vector” {right arrow over (e)} thatencodes m, and then computes the ciphertext as {right arrow over(c)}←{right arrow over (e)} mod B_(pk). Note that if {right arrow over(e)} is short enough (i.e., less than λ₁(L)/2), then it is indeed thedistance between {right arrow over (c)} and the nearest lattice point.

To decrypt, the key-holder uses its “good” basis B_(sk) to recover{right arrow over (e)} by setting {right arrow over (c)}←{right arrowover (c)} mod B_(sk), and then recovers m from {right arrow over (c)}.The reason decryption works is that, if the parameters are chosencorrectly, then the parallelepiped P(B_(sk)) of the secret key will be a“plump” parallelepiped that contains a sphere of radius bigger than∥{right arrow over (c)}∥, so that {right arrow over (c)} is the pointinside P(B_(sk)) that equals {right arrow over (c)} modulo L. On theother hand, the parallelepiped P(B_(pk)) of the public key will be veryskewed, and will not contain a sphere of large radius, making it uselessfor solving BDDP.

2.4 Gentry's Somewhat-Homomorphic Cryptosystem

Gentry's somewhat homomorphic encryption scheme [3] can be seen as aGGH-type scheme over ideal lattices. The public key consists of a “bad”basis B_(pk) of an ideal lattice J, along with some basis B_(I) of a“small” ideal I (which is used to embed messages into the errorvectors). For example, the small ideal I can be taken to be I=(2), theset of vectors with all even coefficients.

A ciphertext in Gentry's scheme is a vector close to a J-point, with themessage being embedded in the distance to the nearest lattice point.More specifically, the plaintext space is (some subset of)R/I={0,1}^(n), for a message for a message in {right arrow over(m)}ε{0,1}^(n) set {right arrow over (e)}=2{right arrow over (r)}+{rightarrow over (m)} for a random small vector {right arrow over (r)}, andthen output the ciphertext {right arrow over (c)}←{right arrow over (e)}mod B_(pk).

The secret key in Gentry's scheme (that plays the role of the “goodbasis” of J) is just a short vector {right arrow over (w)}εJ⁻¹.Decryption involves computing the fractional part [{right arrow over(w)}×{right arrow over (c)}]. Since {right arrow over (c)}={right arrowover (j)}+{right arrow over (e)} for some jεJ, then {right arrow over(w)}×{right arrow over (c)}={right arrow over (w)}×{right arrow over(j)}+{right arrow over (w)}×{right arrow over (e)}. But {right arrowover (w)}×{right arrow over (j)} is in R and thus an integer vector, so{right arrow over (w)}×{right arrow over (c)} and {right arrow over(w)}×{right arrow over (e)} have the same fractional part, [{right arrowover (w)}×{right arrow over (c)}]=[{right arrow over (w)}×{right arrowover (e)}]. If {right arrow over (w)} and {right arrow over (e)} areshort enough—in particular, if one has the guarantee that all of thecoefficients of {right arrow over (w)}×{right arrow over (e)} havemagnitude less than ½—then [{right arrow over (w)}×{right arrow over(e)}] equals {right arrow over (w)}×{right arrow over (e)} exactly. From{right arrow over (w)}×{right arrow over (e)}, the decryptor canmultiply by {right arrow over (w)}⁻¹ to recover {right arrow over (e)},and then recover {right arrow over (m)}←{right arrow over (e)} mod 2.The actual decryption procedure from [3] is slightly different, however.Specifically, {right arrow over (w)} is “tweaked” so that decryption canbe implemented as {right arrow over (m)}←{right arrow over (c)}−[{rightarrow over (w)}×{right arrow over (c)}] mod 2 (when I=(2)).

The reason that this scheme is somewhat homomorphic is that for twociphertexts {right arrow over (c)}₁={right arrow over (j)}₁+{right arrowover (e)}₁ and {right arrow over (c)}₂={right arrow over (j)}₂+{rightarrow over (e)}₂, their sum is {right arrow over (j)}₃+{right arrow over(e)}₃ where {right arrow over (j)}₃={right arrow over (j)}₁+{right arrowover (j)}₂εJ and {right arrow over (e)}₃={right arrow over (e)}₁+{rightarrow over (e)}₂ is small. Similarly, their product is {right arrow over(j)}₄+{right arrow over (e)}₄ where {right arrow over (j)}₄={right arrowover (j)}₁×({right arrow over (j)}₂+{right arrow over (e)}₂)+{rightarrow over (e)}₁×{right arrow over (j)}₂εJ and {right arrow over(e)}₄={right arrow over (e)}₁×{right arrow over (e)}₂ is still small. Iffresh encrypted ciphertexts are very very close to the lattice, then itis possible to add and multiply ciphertexts for a while before the errorgrows beyond the decryption radius of the secret key.

2.4.1 The Smart-Vercauteren Variant

Smart and Vercauteren [13] work over the ring R=Z[x]/f_(n)(x), wheref_(n)(x)=x^(n)+1 and n is a power of two. The ideal J is set as aprinciple ideal by choosing a vector {right arrow over (v)} at randomfrom some n-dimensional cube, subject to the condition that thedeterminant of ({right arrow over (v)}) is prime, and then settingJ=({right arrow over (v)}). It is known that such ideals can beimplicitly represented by only two integers, namely the determinantd=det(J) and a root r of f_(n)(x)modulo d. (An easy proof of this fact“from first principles” can be derived from Lemma 1 below.)Specifically, the Hermite Normal Form (HNF) of this ideal lattice is:

$\begin{matrix}{{H\; N\; {F(J)}} = \begin{bmatrix}d & 0 & 0 & 0 & 0 \\{- r} & 1 & 0 & 0 & 0 \\{- \left\lbrack r^{2} \right\rbrack_{d}} & 0 & 1 & 0 & 0 \\{- \left\lbrack r^{3} \right\rbrack_{d}} & 0 & 0 & 1 & 0 \\\; & \; & \; & \ddots & \; \\{- \left\lbrack r^{n - 1} \right\rbrack_{d}} & 0 & 0 & 0 & 1\end{bmatrix}} & (1)\end{matrix}$

It is easy to see that reducing a vector {right arrow over (a)} moduloHNF (J) consists of evaluating the associated polynomial a(x) at thepoint r modulo d, then outputting the vector

[a(r)]_(d), 0, 0, . . . , 0

(see Section 5). Hence encryption of a vector

m, 0, 0, . . . , 0

with mε{0,1} can be done by choosing a random small polynomial u(x) andevaluating it at r, then outputting the integer c←[2u(r)+m]_(d).

Smart and Vercauteren also describe a decryption procedure that uses asingle integer was the secret key, setting m←(c−┌cw/d┘)mod 2. Jumpingahead, it is noted that the decryption procedure from Section 6 is verysimilar, except that the rational division cw/d is replaced by modularmultiplication [cw]_(d).

2.5 Gentry's Fully-Homomorphic Scheme

As explained above, Gentry's somewhat-homomorphic scheme can evaluatelow-degree polynomials but not more. Once the degree (or the number ofterms) is too large, the error vector {right arrow over (e)} growsbeyond the decryption capability of the private key. Gentry solved thisproblem using bootstrapping. He observed in [3] that a scheme that canhomomorphically evaluate its own decryption circuit plus one additionaloperation, can be transformed into a fully-homomorphic encryption. Inmore details, fix two ciphertexts {right arrow over (c)}₁, {right arrowover (c)}₂ and consider the functions:

${{DAdd}_{{\overset{\rightarrow}{c}}_{1},{\overset{\rightarrow}{c}}_{2}}({sk})}\overset{def}{=}{{{{Dec}_{sk}\left( {\overset{\rightarrow}{c}}_{1} \right)} + {{{Dec}_{sk}\left( {\overset{\rightarrow}{c}}_{2} \right)}\mspace{14mu} {and}\mspace{14mu} {{DMul}_{{\overset{\rightarrow}{c}}_{1},{\overset{\rightarrow}{c}}_{2}}({sk})}}}\overset{def}{=}{{{Dec}_{sk}\left( {\overset{\rightarrow}{c}}_{1} \right)} \times {{{Dec}_{sk}\left( {\overset{\rightarrow}{c}}_{2} \right)}.}}}$

A somewhat-homomorphic scheme is called “bootstrappable” if it iscapable of homomorphically evaluating the functionsDAdd_({right arrow over (c)}) ₁ _(,{right arrow over (c)}) ₂ andDMul_({right arrow over (c)}) ₁ _(,{right arrow over (c)}) ₂ for any twociphertexts {right arrow over (c)}₁, {right arrow over (c)}₂. Given abootstrappable scheme that is also circular secure, it can betransformed into a fully-homomorphic scheme by adding to the public keyan encryption of the secret key, {right arrow over (c)}*←Enc_(pk)(sk).Then given any two ciphertexts {right arrow over (c)}₁, {right arrowover (c)}₂, the addition/multiplication of these two ciphertexts can becomputed by homomorphically evaluating the functionsDAdd_({right arrow over (c)}) ₁ _(,{right arrow over (c)}) ₂ ({rightarrow over (c)}*) or DMul_({right arrow over (c)}) ₁_(,{right arrow over (c)}) ₂ ({right arrow over (c)}*). Note that theerror does not grow, since one always evaluates these functions on thefresh ciphertext {right arrow over (c)}* from the public key.

Unfortunately, the somewhat-homomorphic scheme from above is notbootstrappable. Although it is capable of evaluating low-degreepolynomials, the degree of its decryption function, when expressed as apolynomial in the secret key bits, is too high. To overcome this problemGentry shows how to “squash the decryption circuit”, transforming theoriginal somewhat-homomorphic scheme E into a scheme E* that cancorrectly evaluate any circuit that E can, but where the complexity ofE*'s decryption circuit is much less than E's. In the originalsomewhat-homomorphic scheme E, the secret key is a vector {right arrowover (w)}. In the new scheme E*, the public key includes an additional“hint” about {right arrow over (w)}—namely, a big set of vectorsS={{right arrow over (x)}_(i):i=1, 2, . . . , S} that have a hiddensparse subset T that adds up to {right arrow over (w)}. The secret keyof E* is the characteristic vector of the sparse subset T, which isdenoted {right arrow over (σ)}=

{right arrow over (σ)}₁, {right arrow over (σ)}₂, . . . , {right arrowover (σ)}_(S)

.

Whereas decryption in the original scheme involved computing {rightarrow over (m)}←{right arrow over (c)}−[{right arrow over (w)}×{rightarrow over (c)}] mod 2, in the new scheme the ciphertext {right arrowover (c)} is “post-processed” by computing the products {right arrowover (y)}_(i)={right arrow over (x)}_(i)×{right arrow over (c)} for allof the vectors {right arrow over (x)}_(i)εS. Obviously, then, thedecryption in the new scheme can be done by computing {right arrow over(c)}−[Σ_(j)σ_(j){right arrow over (y)}_(j)] mod 2. Using some additionaltricks, this computation can be expressed as a polynomial in the σ_(i)'sof degree roughly the size of the sparse subset T. (The underlyingalgorithm is simple grade-school addition—add up the least significantcolumn, bring a carry bit over to the next column if necessary, and soon.) With appropriate setting of the parameters, the subset T can bemade small enough to get a bootstrappable scheme.

The “Somewhat Homomorphic” Scheme

3 Key Generation

Herein an approach similar to the Smart-Vercauteren approach [13] isadopted, in that the scheme also uses principal-ideal lattices in thering of polynomials modulo

${f_{n}(x)}\overset{def}{=}{x^{n} + 1}$

with n a power of two. Unlike Smart-Vercauteren, it is not required thatthese principal-ideal lattices have prime determinant, instead one onlyneeds the HNF to have the same form as in Equation (1). Duringkey-generation choose {right arrow over (v)} at random in some cube,verify that the HNF has the right form, and work with the principalideal ({right arrow over (v)}). There are two parameters: the dimensionn, which must be a power of two, and the bit-size t of coefficients inthe generating polynomial. Key-generation consists of the followingsteps:

-   -   1. Choose a random n-dimensional integer lattice {right arrow        over (v)}, where each entry v_(i) is chosen at random as a t-bit        (signed) integer. With this vector {right arrow over (v)}        associate the formal polynomial

${{v(x)}\overset{def}{=}{\sum\limits_{i = 0}^{n - 1}{v_{i}x^{i}}}},$

as well as the rotation basis:

$\begin{matrix}{V = \begin{bmatrix}v_{0} & v_{1} & v_{2} & \; & v_{n - 1} \\{- v_{n - 1}} & v_{0} & v_{1} & \; & v_{n - 2} \\{- v_{n - 2}} & {- v_{n - 1}} & v_{0} & \; & v_{n - 3} \\\; & \; & \; & \ddots & \; \\{- v_{1}} & {- v_{2}} & {- v_{3}} & \; & v_{0}\end{bmatrix}} & (2)\end{matrix}$

The i'th row is a cyclic shift of {right arrow over (v)} by i positionsto the right, with the “overflow entries” negated. Note that the i'throw corresponds to the coefficients of the polynomialv_(i)(x)=v(x)×x^(i)(mod f_(n)(x)). Note that just like V itself, theentire lattice L(V) is also closed under “rotation”: Namely, for anyvector

u₀, u₁, . . . , u_(n−1)

εL(V), also the vector

−u_(n−1), u₀, . . . , u_(n−2)

is in L(V).

-   -   2. Next compute the scaled inverse of v(x)modulo f_(n)(x),        namely an integer polynomial w(x) of degree at most n−1, such        that w(x)×v(x)=constant(mod f_(n)(x)). Specifically, this        constant is the determinant of the lattice L(V), which must be        equal to the resultant of the polynomials v(x) and f_(n)(x)        (since f_(n) is monic). Below the resultant is denoted by d, and        the coefficient-vector of w(x) is denoted by {right arrow over        (w)}=        w₀, w₁, . . . , w_(n−1)        . It is easy to check that the matrix:

$\begin{matrix}{W = \begin{bmatrix}w_{0} & w_{1} & w_{2} & \; & w_{n - 1} \\{- w_{n - 1}} & w_{0} & w_{1} & \; & w_{n - 2} \\{- w_{n - 2}} & {- w_{n - 1}} & w_{0} & \; & w_{n - 3} \\\; & \; & \; & \ddots & \; \\{- w_{1}} & {- w_{2}} & {- w_{3}} & \; & w_{0}\end{bmatrix}} & (3)\end{matrix}$

is the scaled inverse of V, namely W×V=V×W=d·I. One way to compute thepolynomial w(x) is by applying the extended Euclidean-GCD algorithm (forpolynomials) to v(x) and f_(n)(x). See Section 4 for a more efficientmethod of computing w(x).

-   -   3. Next check that this is a good generating polynomial.        Specifically, consider {right arrow over (v)} to be good if the        HNF of V has the same form as in Equation (1), namely all except        the leftmost column equal to the identity matrix. See below for        a simple check that {right arrow over (v)} is good, a condition        tested while computing the inverse.

It was observed by Nigel Smart that the HNF has the correct formwhenever the determinant is odd and square-free. Indeed, in tests thiscondition was met with probability roughly 0.5, irrespective of thedimension and bit length, with the failure cases usually due to thedeterminant if V being even.

Checking the HNF.

Lemma 1 below proves that the HNF of the lattice L(V) has the right formif and only if the lattice contains a vector of the form

−r, 1, 0, . . . , 0

. Namely, if and only if there exists an integer vector {right arrowover (y)} and another integer r such that

{right arrow over (y)}×V=

−r, 1, 0, . . . , 0

Multiplying the last equation on the right by W, one gets the equivalentcondition

{right arrow over (y)}×V×W=

−r, 1, 0, . . . , 0

×W

{right arrow over (y)}×(dI)=d·{right arrow over (y)}=−r·

w ₀ , w ₁ , w ₂ , . . . , w _(n−1)

+

−w _(n−1) , w ₀ , w ₁ , . . . , w _(n−2)

  (4)

In other words, there must exist an integer r such that the second rowof W minus r times the first row yields a vector of integers that areall divisible by d:

−r·

w ₀ , w ₁ , w ₂ , . . . , w _(n−1)

+

−w _(n−1) , w ₀ , w ₁ , . . . , w _(n−2)

=0(mod d)

−r·

w ₀ , w ₁ , w ₂ , . . . , w _(n−1)

=

w _(n−1) , −w ₀ , −w ₁ , . . . , −w _(n−2)

(mod d)

The last condition can be checked easily: compute r:=w₀/w₁ mod d(assuming that w₁ has an inverse modulo d), then check thatr·w_(i+1)=w_(i)(mod d) holds for all i=1, . . . , n−2 and also−r·w₀=w_(n−1)(mod d). Note that in particular this means thatr^(n)=−1(mod d). (In the instant implementation one need actually testonly that last condition, instead of testing all the equalitiesr·w_(i+1)=w_(i)(mod d).)

Lemma 1 Hermite normal form of the matrix V from Equation (2) is equalto the identity matrix in all but the leftmost column, if and only ifthe lattice spanned by the rows of V contains a vector of the form{right arrow over (m)}=

−r, 1, 0 . . . , 0

.

Proof Let B be the Hermite normal form of V. Namely, B is a lowertriangular matrix with non-negative diagonal entries, where the rows ofB span the same lattice as the rows of V, and the absolute value ofevery entry under the diagonal in B is no more than half the diagonalentry above it. This matrix B can be obtained from V by a sequence ofelementary row operations, and it is unique. It is easy to see that theexistence of a vector {right arrow over (r)} of this form is necessary:indeed the second row of B must be of this form (since B is equal theidentity in all except the leftmost column). It is now proven that thiscondition is also sufficient. It is clear that the vector d·{right arrowover (e)}₁=

d, 0, . . . , 0

belongs to L(V): in particular

w₀, w₁, . . . , w_(n−1)

×V=

d, 0, . . . , 0

. Also, by assumption one has {right arrow over (r)}=−r·{right arrowover (e)}₁+{right arrow over (e)}₂εL(V), for some integer r. Note thatone can assume without loss of generality that −d/2≦r<d/2, sinceotherwise one could subtract from {right arrow over (r)} multiples ofthe vector d·{right arrow over (e)}₁ until this condition is satisfied:

${{\langle{{- r}\mspace{14mu} 10\mspace{14mu} \ldots \mspace{14mu} 0}\rangle} - {\kappa \cdot {\langle{d\mspace{14mu} 00\mspace{14mu} \ldots \mspace{14mu} 0}\rangle}}} = {\overset{\_}{\langle{\left\lbrack {- r} \right\rbrack_{d}10\mspace{14mu} \ldots \mspace{14mu} 0}\rangle}\quad}$

For i=1, 2, . . . , n−1, denote

$r_{i}\overset{def}{=}{\left\lbrack r^{i} \right\rbrack_{d}.}$

Below it will be proven by induction that for all i=1, 2, . . . , n−1,the lattice L(V) contains the vector:

${\overset{\rightarrow}{r}}_{i}\overset{def}{=}{{{{- r_{i}} \cdot {\overset{\rightarrow}{e}}_{1}} + {\overset{\rightarrow}{e}}_{i + 1}} = {\underset{\underset{{1\mspace{14mu} {in}\mspace{14mu} {the}\mspace{14mu} i} + {1^{\prime}{st}\mspace{14mu} {position}}}{}}{\langle{{- r_{i}},{0\mspace{14mu} \ldots \mspace{14mu} 0},1,{0\mspace{14mu} \ldots \mspace{14mu} 0}}\rangle}.}}$

Placing all these vectors {right arrow over (r)}_(i) at the rows of amatrix, one gets exactly the matrix B that is needed:

$\begin{matrix}{B = {\begin{bmatrix}d & 0 & 0 & 0 \\{- r_{1}} & 1 & 0 & 0 \\{- r_{2}} & 0 & 1 & 0 \\\; & \; & \ddots & \; \\{- r_{n - 1}} & 0 & 0 & 1\end{bmatrix}.}} & (5)\end{matrix}$

B is equal to the identity except in the leftmost column, its rows areall vectors in L(V) (so they span a sub-lattice), and since B has thesame determinant as V then it cannot span a proper sub-lattice, it musttherefore span L(V) itself. It is left to prove the inductive claim. Fori=1 set

${\overset{\rightarrow}{r}}_{1}\overset{def}{=}\overset{\rightarrow}{r}$

and the claim follows from the assumption that {right arrow over(r)}εL(V). Assume now that it holds for some Iε[1,n−2] and it is provenfor i+1. Recall that the lattice L(V) is closed under rotation, andsince {right arrow over (r)}_(i)=−r_(i){right arrow over (e)}₁+{rightarrow over (e)}_(i+1)εL(V) then the right-shifted vector

${\overset{\rightarrow}{s}}_{i + 1}\overset{def}{=}{{{- r_{i}}{\overset{\rightarrow}{e}}_{2}} + {\overset{\rightarrow}{e}}_{i + 2}}$

is also in L(V). This is a circular shift, since i≦n−2 and hence therightmost entry in {right arrow over (r)}_(i) is zero. Hence L(V)contains also the vector:

{right arrow over (s)} _(i+1) +r _(i) ·{right arrow over (r)}=(−r _(i){right arrow over (e)} ₂ +{right arrow over (e)} _(i+2))+r _(i)(−r{rightarrow over (e)} ₁ +{right arrow over (e)} ₂)==−r _(i) r·{right arrowover (e)} ₁ +{right arrow over (e)} _(i+2)

One can now reduce the first entry in this vector modulo d, byadding/subtracting the appropriate multiple of d·{right arrow over (e)}₁(while still keeping it in the lattice), thus getting the latticevector:

[−r·r _(i)]_(d) ·{right arrow over (e)} ₁ +{right arrow over (e)} _(i+2)=−[r ^(i+1)]_(d) ·{right arrow over (e)} ₁ +{right arrow over (e)}_(i+2) ={right arrow over (r)} _(i+1) εL(V)

This concludes the proof.

Remark 1 Note that the proof of Lemma 3 shows in particular that if theHermite normal form of V is equal to the identity matrix in all but theleftmost column, then it must be of the form specified in Equation (13).Namely, the first column is

d, −r₁, −r₂, . . . , −r_(n−1)

^(t), with r_(i)=[r^(i)]_(d) for all i. Hence this matrix can berepresented implicitly by the two integers d and r.

3.1 The Public and Secret Keys

In principle the public key is the Hermite normal form of V, but asexplained above and in Section 5 it is enough to store for the publickey only the two integers d,r. Similarly, in principle the secret key isthe pair ({right arrow over (v)}, {right arrow over (w)}), but asexplained in Section 6.1 it is sufficient to store only a single (odd)coefficient of {right arrow over (w)} and discard {right arrow over (v)}altogether.

4 Inverting the Polynomial v(x)

The fastest known methods for inverting the polynomial v(x)modulof_(n)(x)=x^(n)+1 are based on Fast Fourier Transform (FFT): One canevaluate v(x) at all the roots of f_(n)(x) (either over the complexfield or over some finite field), then compute w*(ρ)=1/v(ρ) (whereinversion is done over the corresponding field), and then interpolatew*=v⁻¹ from all these values. If the resultant of v and f_(n) has Nbits, then this procedure will take O(n log n) operations over O(N)-bitnumbers, for a total running time of Õ(nN). This is close to optimal ingeneral, since just writing out the coefficients of the polynomial w*takes time O(nN). However, in Section 6.1 it is shown that it is enoughto use for the secret key only one of the coefficients of w=d·w* (whered=resultant(v, f_(n))). This raises the possibility that one can computethis one coefficient in time quasi-linear in N (rather than quasi-linearin nN). Below is described a method for doing just that.

The method relies heavily on the special form of f_(n)(x)=x^(n)+1, withn being a power of two. Let ρ₀, ρ₁, . . . , ρ_(n−1) be roots of f_(n)(x)over the complex field: That is, if ρ is some primitive 2n'th root ofunity then ρ_(i)=ρ^(2i+1). Note that the roots r_(i) satisfy that

$\rho_{i + \frac{n}{2}} = {- \rho_{i}}$

for all i, and more generally for every index i (with index arithmeticmodulo n) and every j=0, 1, . . . , log n, if one denotes

$n_{j}\overset{def}{=}{n/2^{j}}$

then it holds that:

$\begin{matrix}{\left( \rho_{i + {n_{j}/2}} \right)^{2^{j}} = {\left( \rho^{{2i} + n_{j} + 1} \right)^{2^{j}} = {{\left( \rho^{{2i} + 1} \right)^{2^{j}} \cdot \rho^{n}} = {- \left( \rho_{i}^{2^{j}} \right)}}}} & (6)\end{matrix}$

The method below takes advantage of Equation (6), as well as aconnection between the coefficients of the scaled inverse w and those ofthe formal polynomial:

${g(z)}\overset{def}{=}{\prod\limits_{i = 0}^{n - 1}\; {\left( {{v\left( \rho_{i} \right)} - z} \right).}}$

Invert v(x)mod f_(n)(x) by computing the lower two coefficients of g(z),then using them to recover both the resultant and one coefficient of thepolynomial w(x), as described next.

Step One: the Polynomial g(z).

Note that although the polynomial g(z) it is defined via the complexnumbers ρ_(i), the coefficients of g(z) are all integers. Below, it isshown how to compute the lower two coefficients of g(z), namely thepolynomial g(z)mod z². It is observed that since

$\rho_{i + \frac{n}{2}} = {- \rho_{i}}$

then one can write g(z) as:

$\begin{matrix}{{g(z)} = {\prod\limits_{i = 0}^{\frac{n}{2} - 1}\; {\left( {{v\left( \rho_{i} \right)} - z} \right)\left( {{v\left( {- \rho_{i}} \right)} - z} \right)}}} \\{= {{\prod\limits_{i = 0}^{\frac{n}{2} - 1}\; \underset{a{(\rho_{i})}}{\left( \underset{}{{v\left( \rho_{i} \right)}{v\left( {- \rho_{i}} \right)}} \right.}} - {z\underset{b{(\rho_{i})}}{\left. {\left( \underset{}{{v\left( \rho_{i} \right)} + {v\left( {- \rho_{i}} \right)}} \right) + z^{2}} \right)}}}} \\{= {\prod\limits_{i = 0}^{\frac{n}{2} - 1}{\left( {{a\left( \rho_{i} \right)} - {z\; {b\left( \rho_{i} \right)}}} \right)\left( {{mod}\; z^{2}} \right)}}}\end{matrix}$

Observe further that for both the polynomials a(x)=v(x)v(−x) andb(x)=v(x)+v(−x), all the odd powers of x have zero coefficients.Moreover, the same equalities as above hold if one uses A(x)=a(x)modf_(n)(x) and B(x)=b(x)mod f_(n)(x) instead of a(x) and b(x) themselves(since one only evaluates these polynomials in roots of f_(n)), and alsofor A,B all the odd powers of x have zero coefficients (since onereduces modulo f_(n)(x)=x^(n)+1 with n even).

Thus one can consider the polynomials {circumflex over (v)},{tilde over(v)} that have half the degree and only use the nonzero coefficients ofA,B, respectively. Namely they are defined via {circumflex over(v)}(x²)=A(x) and {tilde over (v)}(x²)=B(x). Thus the task of computingthe n-product involving the degree-n polynomial v(x) is reduced tocomputing a product of only n/2 terms involving the degree-n/2polynomials {circumflex over (v)}(x),{tilde over (v)}(x). Repeating thisprocess recursively, one obtains the polynomial g(z)mod z².

In more detail, denote U₀(x)≡1 and V₀(x)=v(x), and for j=0, 1, . . . ,log n denote n_(j)=n/2^(j). Proceed in m=log n steps to compute thepolynomials U_(j)(x),V_(j)(x) (j=1, 2, . . . , m), such that the degreesof U_(j), V_(j) are at most n_(j)−1, and moreover the polynomialg_(j)(z)=Π_(i=0) ^(n) ^(j) ⁻¹(V_(j)(ρ_(i) ² ^(j) )−zU_(j)(ρ_(i) ² ^(j))) has the same first two coefficients as g(z). Namely,

$\begin{matrix}{{g_{j}(z)}\overset{def}{=}{{\prod\limits_{i = 0}^{n_{j} - 1}\left( {{V_{j}\left( \rho_{i}^{2^{j}} \right)} - {z\; {U_{j}\left( \rho_{i}^{2^{j}} \right)}}} \right)} = {{g(z)}{\left( {{mod}\; z^{2}} \right).}}}} & (7)\end{matrix}$

Equation (7) holds for j=0 by definition. Assume that U_(j),V_(j) arecomputed for some j<m such that Equation (7) holds, and it is shownbelow how to compute U_(j+1) and V_(j+1). From Equation (6) one knowsthat (ρ_(i+n) _(j) _(/2))² ^(j) =ρ_(i) ² ^(j) , so one can express g_(j)as:

$\begin{matrix}{{g_{j}(z)} = {\prod\limits_{i = 0}^{{n_{j}/2} - 1}\; {\left( {{V_{j}\left( \rho_{i}^{2^{j}} \right)} - {z\; {U_{j}\left( \rho_{i}^{2^{j}} \right)}}} \right)\left( {{V_{j}\left( {- \rho_{i}^{2^{j}}} \right)} - {z\; {U_{j}\left( {- \rho_{i}^{2^{j}}} \right)}}} \right)}}} \\{= {\prod\limits_{i = 0}^{{n_{j}/2} - 1}{\left( \; \begin{matrix}{\underset{= {A_{j}{(\rho_{i}^{2^{j}})}}}{\underset{}{{V_{j}\left( \rho_{i}^{2^{j}} \right)}{V_{j}\left( {- \rho_{i}^{2^{j}}} \right)}}} -} \\{z\left( \underset{= {B_{j}{(\rho_{i}^{2^{j}})}}}{\underset{}{{{U_{j}\left( \rho_{i}^{2^{j}} \right)}{V_{j}\left( {- \rho_{i}^{2^{j}}} \right)}} + {{U_{j}\left( {- \rho_{i}^{2^{j}}} \right)}{V_{j}\left( \rho_{i}^{2^{j}} \right)}}}} \right)}\end{matrix} \right)\left( {{mod}\; z^{2}} \right)}}}\end{matrix}$

Denoting

$f_{n_{j}} = {(x)\overset{def}{=}{x^{n_{j}} + 1}}$

and observing that ρ_(i) ² ^(j) is a root of f_(n) _(j) for all i, onenext considers the polynomials:

$\mspace{20mu} {{A_{j}(x)}\overset{def}{=}{{V_{j}(x)}{V_{j}\left( {- x} \right)}{mod}\; {f_{n_{j}}(x)}\left( {{{with}\mspace{14mu} {coefficients}\mspace{14mu} a_{0}},\ldots \mspace{14mu},a_{n_{j} - 1}} \right)}}$${B_{j}(x)}\overset{def}{=}{{{U_{j}(x)}{V_{j}\left( {- x} \right)}} + {{U_{j}\left( {- x} \right)}{V_{j}(x)}{mod}\; {f_{n_{j}}(x)}\left( {{{with}\mspace{14mu} {coefficients}\mspace{14mu} b_{0}},\ldots \mspace{14mu},b_{n_{j} - 1}} \right)}}$

and observes the following:

-   -   Since ρ_(i) ² ^(j) is a root of f_(n) _(j) , then the reduction        modulo f_(n) _(j) makes no difference when evaluating        A_(j),B_(j) on ρ_(i) ² ^(j) . Namely one has A_(j)(ρ_(i) ² ^(j)        )=V_(j)(ρ_(i) ² ^(j) )V_(j)(−ρ_(i) ² ^(j) ) and similarly        B_(j)(ρ_(i) ² ^(j) )=U_(j)(ρ_(i) ² ^(j) )V_(j)(−ρ_(i) ² ^(j)        )+U_(j)(−ρ_(i) ² ^(j) )V_(j)(ρ_(i) ² ^(j) ) (for all i).    -   The odd coefficients of A_(j),B_(j) are all zero. For A_(j) this        is because it is obtained as V_(j)(x)V_(j)(−x) and for B_(j)        this is because it is obtained as R_(j)(x)+R_(j)(−x) (with        R_(j)(x)=U_(j)(x)V_(j)(−x)). The reduction modulo f_(n) _(j)        (x)=x^(n) ^(j) +1 keeps the odd coefficients all zero, because        n_(j) is even.

Therefore set:

${{U_{j + 1}(x)}\overset{def}{=}{\sum\limits_{t = 0}^{{n_{j}/2} - 1}{b_{2t} \cdot x^{t}}}},{{{and}\mspace{14mu} {V_{j + 1}(x)}}\overset{def}{=}{\sum\limits_{t = 0}^{{n_{j}/2} - 1}{a_{2t} \cdot x^{t}}}},$

so the second bullet above implies that U_(j+1)(x²)=B_(j)(x) andV_(j+1)(x²)=A_(j)(x) for all x. Combined with the first bullet, one hasthat:

$\begin{matrix}{{g_{j + 1}(z)}\overset{def}{=}{\prod\limits_{i = 0}^{{n_{j}/2} - 1}\left( {{V_{j + 1}\left( \rho_{i}^{2^{j + 1}} \right)} - {{z\; \cdot U_{j + 1}}\left( \rho_{i}^{2^{j + 1}} \right)}} \right)}} \\{= {\prod\limits_{i = 0}^{{n_{j}/2} - 1}\left( {{A_{j}\left( \rho_{i}^{2^{j}} \right)} - {z\; \cdot {B_{j}\left( \rho_{i}^{2^{j}} \right)}}} \right)}} \\{= {{g_{j}(z)}{\left( {{mod}\; z^{2}} \right).}}}\end{matrix}$

By the induction hypothesis one also has g_(j)(z)=g(z)(mod z²), so onegets g_(j+1)(z)=g(z)(mod z²), as needed.

Step Two: Recovering d and w₀.

Recall that if v(x) is square free then d=resultant(v, f_(n))=Π_(i=0)^(n−1)v(ρ_(i)), which is exactly the free term of g(z), g₀=Π_(i=0)^(n−1)v(ρ_(i)).

Recall also that the linear term in g(z) has coefficient g₁=Σ_(i=0)^(n−1)Π_(j≠i)v(ρ_(i)). Next it is shown that the free term of w(x) isw₀=g₁/n. First, observe that g₁ equals the sum of w evaluated in all theroots of f_(n), namely:

$g_{1} = {{\sum\limits_{i = 0}^{n - 1}{\prod\limits_{j \neq i}\; {v\left( \rho_{j} \right)}}} = {{\sum\limits_{i = 0}^{n - 1}\frac{\prod\limits_{j = 0}^{n - 1}\; {v\left( \rho_{j} \right)}}{v\left( \rho_{j} \right)}}\overset{(a)}{=}{{\sum\limits_{i = 0}^{n - 1}\frac{d}{v\left( \rho_{i} \right)}}\overset{(b)}{=}{\sum\limits_{i = 0}^{n - 1}{w\left( \rho_{i} \right)}}}}}$

where Equality (a) follows since v(x) is square free and d=resultant(v,f_(n)), and Equality (b) follows since v(ρ_(i))=d/w(ρ_(i)) holds in allthe roots of f_(n). It is left to show that the constant term of w(x) isw₀=nΣ_(i=0) ^(n−1)w(ρ_(i)). To show this, write:

$\begin{matrix}\begin{matrix}{{\sum\limits_{i = 0}^{n - 1}{w\left( \rho_{i} \right)}} = {\sum\limits_{i = 0}^{n - 1}{\sum\limits_{j = 0}^{n - 1}{w_{j}\rho_{i}^{j}}}}} \\{= {\sum\limits_{j = 0}^{n - 1}{w_{j}{\sum\limits_{i = 0}^{n - 1}\rho_{i}^{j}}}}} \\{\overset{å}{=}{\sum\limits_{j = 0}^{n - 1}{w_{j}{\sum\limits_{i = 0}^{n - 1}\left( \rho^{j} \right)^{{2i} + 1}}}}}\end{matrix} & (8)\end{matrix}$

where the Equality holds since the i'th root of f_(n) is ρ_(i)=ρ^(2i+1)where ρ is a 2n-th root of unity. Clearly, the term corresponding to j=0in Equation (8) is w₀·n, it is left to show that all the other terms arezero. This follows since ρ^(j) is a 2n-th root of unity different from±1 for all j=1, 2, . . . , n−1, and summing over all odd powers of suchroot of unity yields zero.

Step Three: Recovering the Rest of w.

One can now use the same technique to recover all the other coefficientsof w: Note that since one works modulo f_(n)(x)=x^(n)+1, then thecoefficient w_(i) is the free term of the scaled inverse of x^(i)×v(modf_(n)).

In this case one only needs to recover the first two coefficients,however, since interest is in the case where w₁/w₀=w₂/w₁= . . .=w_(n−1)/w_(n−2)=−w₀/w_(n−1) (mod d), where d=resultant (v, f_(n)).After recovering w₀, w₁ and d=resultant(v, f_(n)), compute the ratior=w₁/w₀ mod d and verify that r^(n)=−1(mod d). Then recover as manycoefficients of w as needed (via w_(i+1)=[w_(i)·r]_(d)), until one findsone coefficient which is an odd integer, and that coefficient is thesecret key.

5 Encryption

To encrypt a bit bε{0,1} with the public key B (which is implicitlyrepresented by the two integers d,r), first choose a random 0, ±1 “noisevector”

${\overset{\rightarrow}{u}\overset{def}{=}{\langle{u_{0},u_{1},\ldots \mspace{14mu},u_{n - 1}}\rangle}},$

with each entry chosen as 0 with some probability q and as ±1 withprobability (1−q)/2 each. Then set

${\overset{\rightarrow}{a}\overset{def}{=}{{{2\overset{\rightarrow}{u}} + {b \cdot {\overset{\rightarrow}{e}}_{1}}} = {\langle{{{2u_{0}} + b},{2u_{1}},\ldots \mspace{14mu},{2u_{n - 1}}}\rangle}}},$

and the ciphertext is the vector:

$\begin{matrix}{\overset{\rightarrow}{c} = {\overset{\rightarrow}{a}{mod}\; B}} \\{= {\overset{\rightarrow}{a} - \left( {\left\lceil {\overset{\rightarrow}{a} \times B^{- 1}} \right\rfloor \times B} \right)}} \\{= {\underset{{\lbrack \cdot \rbrack}\mspace{14mu} {is}\mspace{14mu} {fractional}\mspace{14mu} {part}}{\underset{}{\left\lbrack {\overset{\rightarrow}{a} \times B^{- 1}} \right\rbrack}} \times B}}\end{matrix}$

It is now shown that {right arrow over (c)} also can be representedimplicitly by just one integer. Recall that B (and therefore also B⁻¹)are of a special form:

${{B = \begin{bmatrix}d & 0 & 0 & 0 & \; & 0 \\{- r} & 1 & 0 & 0 & \; & 0 \\{- \left\lbrack r^{2} \right\rbrack_{d}} & 0 & 1 & 0 & \; & 0 \\{- \left\lbrack r^{3} \right\rbrack_{d}} & 0 & 0 & 1 & \; & 0 \\\; & \; & \; & \; & \ddots & \; \\{- \left\lbrack r^{n - 1} \right\rbrack_{d}} & 0 & 0 & 0 & \; & 1\end{bmatrix}},{and}}\mspace{14mu}$$B^{- 1} = {\frac{1}{d} \cdot {\begin{bmatrix}1 & 0 & 0 & 0 & \; & 0 \\r & d & 0 & 0 & \; & 0 \\\left\lbrack r^{2} \right\rbrack_{d} & 0 & d & 0 & \; & 0 \\\left\lbrack r^{3} \right\rbrack_{d} & 0 & 0 & d & \; & 0 \\\; & \; & \; & \; & \ddots & \; \\\left\lbrack r^{n - 1} \right\rbrack_{d} & 0 & 0 & 0 & \; & d\end{bmatrix}.}}$

Denote {right arrow over (a)}=

a₀, a₁, . . . , a_(n−1)

, and also denote by a(·) the integer polynomial

${a(x)}\overset{def}{=}{\sum\limits_{i = 0}^{n - 1}{a_{i}{x^{i}.}}}$

Then one has

${\overset{\rightarrow}{a} \times B^{- 1}} = {\langle{\frac{s}{d},a_{1},\ldots \mspace{14mu},a_{n - 1}}\rangle}$

for some integer s that satisfies s=a(r)(mod d). Hence the fractionalpart of {right arrow over (a)}×B⁻¹ is

${\left\lbrack {\overset{\rightarrow}{a} \times B^{- 1}} \right\rbrack = {\langle{\frac{\left\lbrack {a(r)} \right\rbrack_{d}}{d},0,\ldots \mspace{14mu},0}\rangle}},$

and the ciphertext vector is

$\overset{\rightarrow}{c} = {{{\langle{\frac{\left\lbrack {a(r)} \right\rbrack_{d}}{d},0,\ldots \mspace{14mu},0}\rangle} \times B} = {{\langle{\left\lbrack {a(r)} \right\rbrack_{d},0,\ldots \mspace{14mu},0}\rangle}.}}$

Clearly, this vector can be represented implicitly by the integer

$c\overset{def}{=}{\left\lbrack {a(r)} \right\rbrack_{d} = {\left\lbrack {b + {2{\sum\limits_{i = 1}^{n - 1}{u_{i}r^{i}}}}} \right\rbrack_{d}.}}$

Hence, to encrypt the bit b, one only needs to evaluate the 0, ±1noise-polynomial u(·) at the point r, then multiply by two and add thebit b (everything modulo d). Now described is an efficient procedure fordoing so.

5.1 An Efficient Encryption Procedure

The most expensive operation during encryption is evaluating thedegree-(n−1) polynomial u at the point r. Polynomial evaluation usingHorner's rule takes n−1 multiplications, but it is known that for smallcoefficients one can reduce the number of multiplications to onlyO(√{square root over (n)}), see [1, 10]. Moreover, observe that it ispossible to batch this fast evaluation algorithm, and evaluate k suchpolynomials in time O(√{square root over (kn)}).

Begin by noting that evaluating many 0, ±1 polynomials at the same pointx can be done about as fast as a naive evaluation of a singlepolynomial. Indeed, once all the powers (1, x, x², . . . , x^(n−1)) arecomputed then one can evaluate each polynomial just by taking asubset-sum of these powers. As addition is much faster thanmultiplication, the dominant term in the running time will be thecomputation of the powers of x, which only need to be done once for allthe polynomials.

Next, observe that evaluating a single degree-(n−1) polynomial at apoint x can be done quickly given a subroutine that evaluates two degree

$\left. \left\lceil {\frac{n}{2} - 1} \right\rceil \right)$

polynomials at the same point x. Namely, given u(x)=Σ_(i=0)^(n−1)u_(i)x^(i), split it into a “bottom half” u^(bot)(x)=Σ_(i=0)^(n/2−1)u_(i)x^(i) and a “top half” u^(top)(x)=Σ_(i=0)^(n/2−1)u_(i+d/2)x^(i). Evaluating these two smaller polynomials getsy^(bot)=u^(bot)(x) and y^(top)=u^(top)(x), and then one can computey=u(x) by setting y=x^(n/2)y^(top)+y^(bot). If the subroutine forevaluating the two smaller polynomials also returns the value ofx^(n/2), then one needs just one more multiplication to get the value ofy=u(x).

These two observations suggest a recursive approach to evaluating the 0,±1 polynomial u of degree n−1. Namely, repeatedly cut the degree in halfat the price of doubling the number of polynomials, and once the degreeis small enough use the “trivial implementation” of just computing allthe powers of x. Analyzing this approach, denote by M(k,n) the number ofmultiplications that it takes to evaluate k polynomials of degree (n−1).Then one has:

M(k,n)=min(n−1,M(2k,n/2)+k+1)

To see the bound M(k,n)≦M(2k,n/2)+k+1, note that once the top- andbottom-halves of all the k polynomials are evaluated, one needs onemultiplication per polynomial to put the two halves together, and onelast multiplication to compute x^(n) (which is needed in the next levelof the recursion) from x^(n/2) (which was computed in the previouslevel). Obviously, making the recursive call takes less multiplicationsthan the “trivial implementation” whenever n−1>(n/2−1)+k+1. Also, aneasy inductive argument shows that the “trivial implementation” isbetter when n−1<(n/2−1)+k+1. Thus, one gets the recursive formula:

${M\left( {k,n} \right)} = \left\{ \begin{matrix}{{M\left( {{2k},{n/2}} \right)} + k + 1} & {{{when}\mspace{14mu} {n/2}} > {k + 1}} \\{n - 1} & {{otherwise}.}\end{matrix} \right.$

Solving this formula obtains M(k,n)≦min(n−1,√{square root over (2kn)}).In particular, the number of multiplications needed for evaluating asingle degree-(n−1) polynomial is M(1,n)≦√{square root over (2n)}.

This “more efficient” batch procedure relies on the assumption that onehas enough memory to keep all these partially evaluated polynomials atthe same time. The experiments, in view of the equipment used, were onlyable to use it in dimensions up to n=2¹⁵, trying to use it in higherdimension resulted in the process being killed after it ran out ofmemory. A more sophisticated implementation could take the availableamount of memory into account, and stop the recursion earlier topreserve space at the expense of more running time. An alternativeapproach, of course, is to store partial results to disk. Moreexperiments are needed to determine what approach yields betterperformance for which parameters. It is also noted that increases inequipment power (e.g., processing power, storage space, access speed,etc.) may yield practicable solutions for higher dimensions.

5.2 The Euclidean Norm of Fresh Ciphertexts

When choosing the noise vector for a new ciphertext, one wants to makeit as sparse as possible, i.e., increase as much as possible theprobability q of choosing each entry as zero. The only limitation isthat q needs to be bounded sufficiently below 1 to make it hard torecover the original noise vector from c.

There are two types of attacks that should be considered:lattice-reduction attacks that try to find the closest lattice point toc, and exhaustive-search/birthday attacks that try to guess thecoefficients of the original noise vector. The lattice-reduction attacksshould be thwarted by working with lattices with high-enough dimension,so one concentrates here on exhaustive-search attacks. Roughly, if thenoise vector has l bits of entropy, then one expects birthday-typeattacks to be able to recover it in 2^(l/2) time, so one needs to ensurethat the noise has at least 2λ bits of entropy for security parameter λ.Namely, for dimension n one needs to choose q sufficiently smaller thanone so that

${2^{{({1 - q})}n} \cdot \begin{pmatrix}n \\{qn}\end{pmatrix}} > {2^{2\lambda}.}$

Another “hybrid” attack is to choose a small random subset of the powersof r (e.g., only 200 of them) and “hope” that they include all the noisecoefficients. If this holds then one can now search for a small vectorin this low-dimension lattice (e.g., dimension 200). For example, if onewere to work in dimension n=2048 and use only 16 nonzero entries fornoise, then choosing 200 of the 2048 entries one has probability ofabout

$\left( \frac{200}{2048} \right)^{16} \approx 2^{54}$

of including all of them (hence one can recover the original noise bysolving 2⁵⁴ instances of SVP in dimension 200). The same attack willhave success probability of only ≈2⁻⁸⁰ if one were to use 24 nonzeroentries.

For the public challenges a (somewhat aggressive) setting was chosenwhere the number of nonzero entries in the noise vector is between 15and 20. Note that increasing the noise will only have a moderate effecton the performance numbers, for example using 30-40 nonzero entries islikely to cinrease the size of the key (and the running time) by onlyabout 10%.

6 Decryption

The decryption procedure takes the ciphertext c (which implicitlyrepresents the vector {right arrow over (c)}=

c, 0, . . . , 0

) and “in principle” it also has the two matrices V,W. It recovers thevector {right arrow over (a)}=2{right arrow over (u)}+b·{right arrowover (e)}₁ that was used during encryption as:

$\begin{matrix}{\left. \overset{\rightarrow}{a}\leftarrow{\overset{\rightarrow}{c}{mod}\; V} \right. = {\overset{\rightarrow}{c} - \left( {\left\lceil {\overset{\rightarrow}{c} \times \underset{= {W/d}}{\underset{}{V^{- 1}}}} \right\rfloor \times V} \right)}} \\{= {\underset{{\lbrack \cdot \rbrack}\mspace{14mu} {is}\mspace{14mu} {fractional}\mspace{14mu} {part}}{\underset{}{\left\lbrack {\overset{\rightarrow}{c} \times {W/d}} \right\rbrack}} \times V_{,}}}\end{matrix}$

and then outputs the least significant bit of the first entry of {rightarrow over (a)}, namely b:=a₀ mod 2.

The reason that this decryption procedure works is that the rows of V(and therefore also of W) are close to being orthogonal to each other,and hence the “operator infinity-norm” of W is small. Namely, for anyvector {right arrow over (x)}, the largest entry in {right arrow over(x)}×W (in absolute value) is not much larger than the largest entry in{right arrow over (x)} itself. Specifically, the procedure from abovesucceeds when all the entries of {right arrow over (a)}×W are smallerthan d/2 in absolute value. To see that, note that {right arrow over(a)} is the distance between {right arrow over (c)} and some point inthe lattice L(V), namely one can express {right arrow over (c)} as{right arrow over (c)}={right arrow over (y)}×V+{right arrow over (a)}for some integer vector {right arrow over (y)}. Hence one has:

[{right arrow over (c)}×W/d]×V=[{right arrow over (y)}×V×W/d+{rightarrow over (a)}×W/d]

[{right arrow over (a)}×W/d]×V

where the equality (*) follows since {right arrow over (y)}×V×W/d is aninteger vector. The vector [{right arrow over (a)}×W/d]×V is supposed tobe a itself, namely one needs [{right arrow over (a)}×W/d]×V={rightarrow over (a)}=({right arrow over (a)}×W/d)×V. But this last conditionholds if and only if [{right arrow over (a)}×W/d]=({right arrow over(a)}×W/d), i.e., {right arrow over (a)}×W/d is equal to its fractionalpart, which means that every entry in {right arrow over (a)}×W/d must beless than ½ in absolute value.

6.1 An Optimized Decryption Procedure

It is next shown that the encrypted bit b can be recovered by asignificantly cheaper procedure: Recall that the (implicitlyrepresented) ciphertext vector {right arrow over (c)} is decrypted tothe bit b when the distance from c to the nearest vector in the latticeL(V) is of the form {right arrow over (a)}=2{right arrow over(u)}+b{right arrow over (e)}₁, and moreover all the entries in {rightarrow over (a)}×W are less than d/2 in absolute value. As stated above,in this case one has [{right arrow over (c)}×W/d]=[{right arrow over(a)}×W/d]={right arrow over (a)}×W/d, which is equivalent to thecondition [{right arrow over (c)}×W]_(d)=[{right arrow over(a)}×W]_(d)={right arrow over (a)}×W. Recall now that {right arrow over(c)}=

c, 0, . . . , 0

, hence:

[{right arrow over (c)}×W] _(d) =[c·

w ₀ , w ₁ , . . . , w _(n−1)

]_(d)=

[cw₀]_(d) , [cw ₁]_(d) , . . . , [cw _(n−1)]_(d)

.

On the other hand, one has:

[{right arrow over (c)}×W] _(d) ={right arrow over (a)}×W=2{right arrowover (u)}×W+b{right arrow over (e)} ₁ ×W=2{right arrow over (u)}×W+b·

w ₀ , w ₁ , . . . , w _(n−1)

.

Putting these two equations together, one sees that any decryptableciphertext c must satisfy the relation:

[cw ₀]_(d) , [cw ₁]_(d) , . . . , [cw _(n−1)]_(d)

=b·

w₀ , w ₁ , . . . , w _(n−1)

(mod 2)

In other words, for every i one has [c·w_(i)]_(d)=b·w_(i)(mod 2). It istherefore sufficient to keep only one of the w_(i)'s (which must beodd), and then recover the bit b as b:=[c·w_(i)]_(d) mod 2.

7 How Homomorphic is this Scheme?

Some experiments were run to get a handle on the degree and number ofmonomials that the somewhat homomorphic scheme can handle, and to helpchoose the parameters. In these experiments key pairs are generated forparameters n (dimension) and t (bit-length), and for each key pairencrypt many bits, evaluate on the ciphertexts many elementary symmetricpolynomials of various degrees and number of variables, decrypt theresults, and check whether or not one gets back the same polynomials inthe plaintext bits. Table 1 shows supported degree vs. number ofvariables and bit-length of the generating polynomial, all tests wererun in dimension n=128.

TABLE 1 m = #-of-variables t = bit-length m = 64 m = 96 m = 128 m = 192m = 256 t = 64 13 12 11 11 10 t = 128 33 28 27 26 24 t = 256 64 76 66 5856 t = 384 64 96 128 100 95 Cells contain the largest supported degreefor every m, t combination

More specifically, for each key pair polynomials were tested on 64 to256 variables. For every fixed number of variables m, 12 tests were run.In each test m bits were encrypted, evaluating all the elementarysymmetric polynomials in these variables (of degree up to m), decryptingthe results, and comparing them to the results of applying the samepolynomials to the plaintext bits. For each setting of m, the highestdegree was recorded for which all 12 tests were decrypted to the correctvalue. Call this the “largest supported degree” for those parameters.

These experiments used fresh ciphertexts of expected Euclidean lengthroughly 2·√{square root over (20)}≈9, regardless of the dimension. Thiswas done by choosing each entry of the noise vector {right arrow over(u)} as 0 with probability

${1 - \frac{20}{n}},$

and as ±1 with probability

$\frac{10}{n}$

each. With that choice, the degree of polynomials that thesomewhat-homomorphic scheme could evaluate did not depend on thedimension n: Various dimensions were tested from 128 to 2048 with a fewsettings of t and m, and the largest supported degree was nearly thesame in all these dimensions. Thereafter the experiments tested all theother settings only in dimension n=128.

The results are described in Table 1. As expected, the largest supporteddegree grows linearly with the bit-length parameter t, and decreasesslowly with the number of variables (since more variables means moreterms in the polynomial).

These results can be more or less explained by the assumptions that thedecryption radius of the secret key is roughly 2^(t), and that the noisein an evaluated ciphertext is roughly c^(degree)×√{square root over(#-of-monomials)}, where c is close to the Euclidean norm of freshciphertexts (i.e., c≈9). For elementary symmetric polynomials, thenumber of monomials is exactly

$\begin{pmatrix}m \\\deg\end{pmatrix}.$

Hence to handle polynomials of degree deg with m variables, one needs toset t large enough so that

${2^{t} \geq {c^{\deg} \times \sqrt{\begin{pmatrix}m \\\deg\end{pmatrix}}}},$

in order for the noise in the evaluated ciphertexts to still be insidethe decryption radius of the secret key.

Trying to fit the data from Table 1 to this expression, observe that cis not really a constant, rather it gets slightly smaller when t getslarger. For t=64 one has cε[9.14,11.33], for t=128 one hascε[7.36,8.82], for t=256 one gets cε[7.34,7.92], and for t=384 one hascε[6.88,7.45]. The small deviation observed may stem from the fact thatthe norm of the individual monomials is not exactly c^(deg) but ratherhas some distribution around that size, and as a result the norm of thesum of all these monomials differs somewhat from √{square root over(#-of-monomials)} times the expected c^(deg).

A Fully Homomorphic Scheme

8 Squashing the Decryption Procedure

Recall that the decryption routine of the “somewhat homomorphic” schemedecrypts a ciphertext cεZ_(d) using the secret key wεZ_(d) by settingb←[wc]_(d) mod 2. Unfortunately, viewing c,d as constants andconsidering the decryption function D_(c,d)(w)=[wc]_(d) mod 2, thedegree of D_(c,d) (as a polynomial in the secret key bits) is higherthan what the somewhat-homomorphic scheme can handle. Hence that schemeis not yet bootstrappable. To achieve bootstrapping, therefore changethe secret-key format and add some information to the public key to geta decryption routine of lower degree, as done in [3].

On a high level, add to the public key also a “big set” of elements{x_(i)εZ_(d):i=1, 2, . . . , S}, such that there exists a very sparsesubset of the x_(i)'s that sums up to w modulo d. The secret key bitswill be the characteristic vector of that sparse subset, namely a bitvector {right arrow over (σ)}=

σ₁, . . . , σ_(S)

such that the Hamming weight of {right arrow over (σ)} is s<<S, andΣ_(i)σ_(i)x_(i)=w(mod d).

Then, given a ciphertext cεZ_(d), post-process it by computing (in theclear) all the integers

$y_{i}\overset{def}{=}{\langle{cx}_{i}\rangle}_{d}$

(i.e., c times x_(i), reduced modulo d to the interval [0, d)). Thedecryption function D_(c,d)({right arrow over (σ)}) can now be writtenas:

${D_{c,d}\left( \overset{\rightarrow}{\sigma} \right)}\overset{def}{=}{\left\lbrack {\sum\limits_{i = 1}^{S}{\sigma_{i}y_{i}}} \right\rbrack_{d}{mod}\; 2}$

Note that the y_(i)'s are in the interval [0,d) rather than [−d/2,+d/2).This is done for implementation convenience, and correctness is notimpacted since the sum of these y_(i)'s is later reduced again modulo dto the internal [−d/2,+d/2). It is now shown that (under someconditions), this function D_(c,d)(·) can be expressed as a low-degreepolynomial in the bits σ_(i). One has:

$\begin{matrix}{\left\lbrack {\sum\limits_{i = 1}^{S}{\sigma_{i}y_{i}}} \right\rbrack_{d} = {\left( {\sum\limits_{i = 1}^{S}{\sigma_{i}y_{i}}} \right) - {d \cdot \left\lceil \frac{\sum\limits_{i}{\sigma_{i}y_{i}}}{d} \right\rfloor}}} \\{{= {\left( {\sum\limits_{i = 1}^{S}{\sigma_{i}y_{i}}} \right) - {d \cdot \left\lceil {\sum\limits_{i = 1}^{S}{\sigma_{i}\frac{y_{i}}{d}}} \right\rfloor}}},}\end{matrix}$

and therefore to compute D_(c,d)({right arrow over (σ)}) one can reducemodulo 2 each term in the right-hand-side separately, and then XOR allthese terms:

$\begin{matrix}{{D_{c,d}\left( \overset{\rightarrow}{\sigma} \right)} = {\left( {\underset{i = 1}{\overset{S}{\oplus}}{\sigma_{i}{\langle y_{i}\rangle}_{2}}} \right) \oplus {{\langle d\rangle}_{2} \cdot {\langle\left\lceil {\sum\limits_{i = 1}^{S}{\sigma_{i}\frac{y_{i}}{d}}} \right\rfloor\rangle}_{2}}}} \\{= {\underset{i = 1}{\overset{S}{\oplus}}{{\sigma_{i}{\langle y_{i}\rangle}_{2}} \oplus {\langle\left\lceil {\sum\limits_{i = 1}^{S}{\sigma_{i}\frac{y_{i}}{d}}} \right\rfloor\rangle}_{2}}}}\end{matrix}$

(where the last equality follows since d is odd and so

d

₂=1). Note that the y_(i)'s and d are constants that are in the clear,and D_(c,d) is a functions only of the σ_(i)'s. Hence the first big XORis just a linear functions of the σ_(i)'s, and the only nonlinear termin the expression above is the rounding function

${\langle\left\lceil {\sum\limits_{i = 1}^{S}{\sigma_{i}\frac{y_{i}}{d}}} \right\rfloor\rangle}_{2}.$

Observe that if the ciphertext c of the underlying scheme is much closerto the lattice than the decryption capability of w, then wc is similarlymuch closer to a multiple of d than d/2. The bootstrappable scheme willtherefore keep the noise small enough so that the distance from c to thelattice is below 1/(s+1) of the decryption radius, and thus the distancefrom wc to the nearest multiple of d is bounded below d/2(s+1). (Recallthat s is the number of nonzero bits in the secret key.) Namely, onehas:

${{abs}\left( \lbrack{wc}\rbrack_{d} \right)} = {{{abs}\left( \left\lbrack {\sum\limits_{i = 1}^{S}{\sigma_{i}y_{i}}} \right\rbrack_{d} \right)} < \frac{d}{2\left( {s + 1} \right)}}$

and therefore also:

${{{abs}\left( \left\lbrack {\sum\limits_{i = 1}^{S}{\sigma_{i}\frac{y_{i}}{d}}} \right\rbrack \right)} < \frac{1}{2\left( {s + 1} \right)}},$

where abs(*) indicates absolute value.Recall now that the y_(i)'s are all in [0, d−1], and therefore y_(i)/dis a rational number in [0,1). Let p be the precision parameter, whichis set to:

$p\overset{def}{=}{\left\lceil {\log_{2}\left( {s + 1} \right)} \right\rceil.}$

For every i, denote by z_(i) the approximation of y_(i)/d to within pbits after the binary point. Note that z_(i) is in the interval [0,1],and in particular it could be equal to 1. Formally, z_(i) is the closestnumber to y_(i)/d among all the numbers of the form a/2^(p), with a aninteger and 0≦a≦2^(P). Then abs

$\left( {z_{i} - \frac{y_{i}}{d}} \right) \leq 2^{- {({p + 1})}} \leq {{1/2}{\left( {s + 1} \right).}}$

Consider now the effect of replacing one term of the form

$\sigma_{i} \cdot \frac{y_{i}}{d}$

in the sum above by σ_(i)·z_(i): If σ_(i)=0 then the sum remainsunchanged, and if σ_(i)=1 then the sum changes by at most2^(−(p+1))≦½(s+1). Since only s of the σ_(i)'s are nonzero, it followsthat the sum Σ_(i)σ_(i)z_(i) is at most s/2(s+1) away from the sum

$\sum\limits_{i}{\sigma_{i}{\frac{y_{i}}{d}.}}$

And since the distance between the latter sum and the nearest integer issmaller than ½(s+1), then the distance between the former sum and thesame integer is strictly smaller than ½(s+1)+s/2(s+1)=½. It follows thatboth sums will be rounded to the same integer, namely:

$\left\lceil {\sum\limits_{i = 1}^{S}{\sigma_{i}\frac{y_{i}}{d}}} \right\rfloor = \left\lceil {\sum\limits_{i = 1}^{S}{\sigma_{i}z_{i}}} \right\rfloor$

It is concluded that for a ciphertext c which is close enough to theunderlying lattice, the function D_(c,d) can be computed asD_(c,d)({right arrow over (σ)})=

┌Σ_(i)σ_(i)z_(i)┘

₂⊕⊕_(i)σ_(i)

y_(i)

₂, and moreover the only nonlinear part in this computation is theaddition and rounding (modulo two) of the z_(i)'s, which all have only pbits of precision to the right of the binary point.

8.1 Adding the z_(i)'s

Although it was shown in [3] that adding a sparse subset of the “lowprecision” numbers σ_(i)z_(i)'s can be done with a low-degreepolynomial, a naive implementation (e.g., using a simple grade-schooladdition) would require computing about s·S multiplications to implementthis operation. Now described is an alternative procedure that requiresonly about s² multiplications.

For this alternative procedure, use a slightly different encoding of thesparse subset. Namely, instead of having a single vector {right arrowover (σ)} of Hamming weight s, instead keep s vectors {right arrow over(σ)}₁, . . . , {right arrow over (σ)}_(s), each of Hamming weight 1,whose bitwise sum is the original vector {right arrow over (σ)}. (Inother words, split the ‘1’-bits in {right arrow over (σ)} between the svectors {right arrow over (σ)}_(k), putting a single ‘1’ in eachvector.)

In this implementation one also has s different big sets, B₁, . . . ,B_(s), and each vector {right arrow over (σ)}_(k) chooses one elementfrom the corresponding B_(k), such that these s chosen elements sum upto w modulo d. Denote the elements of B_(k) by {x(k,i):i=1, 2, . . . ,S}, and the bits of σ_(k) by σ_(k,i). Also denote

${y\left( {k,i} \right)}\overset{def}{=}{\langle{c \cdot {x\left( {k,i} \right)}}\rangle}_{d}$

and z(k,i) is the approximation of y(k,i)/d with p bits of precision tothe right of the binary point. Using these notations, one can re-writethe decryption function D_(c,d) as:

$\begin{matrix}{{D_{c,d}\left( {{\overset{\rightarrow}{\sigma}}_{i},\ldots \mspace{14mu},{\overset{\rightarrow}{\sigma}}_{s}} \right)} = {{\langle\left\lceil {\sum\limits_{k = 1}^{s}\left( \underset{\underset{q_{k}}{}}{\sum\limits_{i = 1}^{S}{\sigma_{k,i}{z\left( {k,i} \right)}}} \right)} \right\rfloor\rangle}_{2} \oplus {\underset{i,k}{\oplus}{\sigma_{k,i}{\langle{y\left( {k,i} \right)}\rangle}_{2}}}}} & (9)\end{matrix}$

Denoting

$q_{k}\overset{def}{=}{\sum\limits_{i}{\sigma_{k,i}{z\left( {k,i} \right)}}}$

(for k=1, 2, . . . , s), observe that each q_(k) is obtained by adding Snumbers, at most one of which is nonzero. One can therefore compute thej'th bit of q_(k) by simply XOR-ing the j'th bits of all the numbersσ_(k,i)z(k,i) (for i=1, 2, . . . , S), since one knows a-priori that atmost one of these bits in nonzero. When computing homomorphicdecryption, this translates to just adding modulo d all the ciphertextscorresponding to these bits. The result is a set of s numbers u_(j),each with the same precision as the z's (i.e., only p=┌ log(s+1)┘ bitsto the right of the binary point).

Grade-School Addition.

Once one has only s numbers with p=┌ log(s+1)┘ bits of precision inbinary representation, one can use the simple grade-school algorithm foradding them: Arrange these numbers in s rows and p+1 columns: one columnfor each bit-position to the right of the binary point, and one columnfor the bits to the left of the binary point. Denote these columns (fromleft to right) by indexes 0, −1, . . . , −p. For each column keep astack of bits, and process the columns from right (−p) to left (0): foreach column compute the carry bits that it sends to the columns on itsleft, and then push these carry bits on top of the stacks of these othercolumns before moving to process the next column.

In general, the carry bit that column −j sends to column −j+Δ iscomputed as the elementary symmetric polynomial of degree 2^(Δ) in thebits of column −j. If column −j has m bits, then one can compute all theelementary symmetric polynomials in these bits up to degree 2^(Δ) usingless than m2^(Δ) multiplications. The Δ's that are needed as oneprocesses the columns in order (column −p, then 1−p, all the way throughcolumn −1) are p−1, p−1, p−2, p−3, . . . 1, respectively. Also, thenumbers of bits in these columns at the time that they are processed ares, s+1, s+2, . . . , s+p−1, respectively. Hence the total number ofmultiplications throughout this process is bounded by s·2^(p−1)+Σ_(k=1)^(p−1)(s+k)·2^(p−k)=O(s²).

Other Addition Algorithms

One can also use other algorithms to add these s numbers of precision p,which could be done in less than O(s²) multiplications. (For example,using the 3-for-2 trick as proposed in [3] requires only O(s·p)multiplications.) In this exemplary implementation grade-school additionis used nonetheless since (a) it results in a slightly smallerpolynomial degree (only 15 rather than 16, for these parameters); and(b) the additions algorithm takes only about 10% of the total runningtime, hence optimizing its performance had a relatively low priority.

9 Reducing the Public-Key Size

There are two main factors that contribute to the size of the public keyof the fully-homomorphic scheme. One is the need to specify an instanceof the sparse-subset-sum problem, and the other is the need to includein the public key also encryption of all the secret-key bits. In thenext two subsections it is shown how to reduce the size of each of thesetwo parts.

9.1 The Sparse-Subset-Sum Construction

Recall that with the optimization from Section 8.1, this instance of theSparse-Subset-Sum problem consists of s “big sets” B₁, . . . , B_(s),each with S elements in Z_(d), such that there is a collection ofelements, one from each B_(k), that add up to the secret key w modulo d.

Representing all of these big sets explicitly would require putting inthe public key s·S elements from Z_(d). Instead, keep only s elements inthe public key, x₁, . . . , x_(s), and each of these elements implicitlydefines one of the big sets. Specifically, the big sets are defined asgeometric progressions in Z_(d): the k'th big set B_(k) consists of theelements x(k,i)=

x_(k)·R^(i)

_(d) for i=0, 1, . . . , S−1, where R is some parameter. The sparsesubset is still one element from each progression, such that these selements add up to the secret key w. Namely, there is a single indexi_(k) in every big set such that Σ_(k)x(k,i_(k))=w(mod d). The parameterR is set to avoid some lattice-reduction attacks on this specific formof the sparse-subset-sum problem, see the bottom of Section 10.2 formore details.

9.2 Encrypting the Secret Key

As discussed in Section 8.1, the secret key of the squashed schemeconsists of s bit-vectors, each with S bits, such that only one bit ineach vector is one, and the others are all zeros. If one were to encrypteach one of these bits individually, then one would need to include inthe public key s·S ciphertexts, each of which is an element in Z_(d).Instead, it is preferable to include an implicit representation thattakes less space but still allows for computing encryptions of all thesebits.

Since the underlying scheme is somewhat homomorphic, then in principleit is possible to store for each big set B_(k) an encrypted descriptionof the function that on input i outputs 1 if an only if (iff) i=i_(k).Such a function can be represented using only log S bits (i.e., thenumber of bits that it takes to represent i_(k)), and it can beexpressed as a polynomial of total degree log S in these bits. Hence, inprinciple it is possible to represent the encryption of all thesecret-key bits using only s log S ciphertexts, but there are twoserious problems with this solution:

Recall the decryption function from Equation (9), D_(c,d)( . . . )=

┌Σ_(k=1) ^(s)(Σ_(i=1) ^(S)σ_(k,i)z(k,i))┘

₂⊕⊕_(i,k)σ_(k,i)

y(k,i)

₂. Since the encryption of each of the bits σ_(k,i) is now a degree-logS polynomial in the ciphertexts that are kept in the public key, thenone needs the underlying somewhat-homomorphic scheme to supportpolynomials of degrees log S times higher than what would be needed ifall the σ_(k,i) themselves were stored. Perhaps even more troubling isthe increase in running time: Whereas before computing the bits ofq_(k)=Σ_(i=1) ^(S)σ_(k,i)z(k,i) involved only additions, now one alsoneeds S log S multiplications to determine all the σ_(k,i)'s, thusnegating the running-time advantage of the optimization from Section8.1.

Instead, use a different tradeoff that lets one store in the public keyonly O(√{square root over (S)}) ciphertexts for each big set, andcompute p√{square root over (S)} multiplications per each of theq_(k)'s. Specifically, for every big set B_(k) keep in the public keysome c=┌2√{square root over (S)}┐ ciphertexts, all but two of them areencryptions of zero. Then the encryption of every secret-key bit σ_(k,i)is obtained by multiplying two of these ciphertexts. Specifically, leta,bε[1, c], and denote the index of the pair (a,b) (in thelexicographical order over pairs of distinct numbers in [1, c]) by:

${i\left( {a,b} \right)}\overset{def}{=}{{\left( {a - 1} \right) \cdot c} - \begin{pmatrix}a \\2\end{pmatrix} + \left( {b - a} \right)}$

In particular, if a_(k),b_(k) are the indexes of the two 1-encryptions(in the group corresponding to the k'th big set B_(k)), theni_(k)=i(a_(k)b_(k)).

A naive implementation of the homomorphic decryption with thisrepresentation will compute explicitly the encryption of every secretkey bit (by multiplying two ciphertexts), and then add a subset of theseciphertexts. Here one can use a better implementation, where first addthe ciphertexts in groups before multiplying. Specifically, let {ηhdm^((k)):k ε[s], mε[c]} be the bits whose encryption is stored in thepublic key (where for each k exactly two of the bits ηhd m^((k)) are ‘1’and the rest are ‘0’, and each of the bits σ_(k,i) is obtained as aproduct of two of the ηhd m^((k))'s). Then compute each of the q_(k)'sas:

$\begin{matrix}{q_{k} = {{\sum\limits_{a,b}{\underset{\underset{\sigma {({k,{i{({a,b})}}})}}{}}{\eta_{a}^{(k)}\eta_{b}^{(k)}}{z\left( {k,{i\left( {a,b} \right)}} \right)}}} = {\sum\limits_{a}{\eta_{a}^{(k)}{\sum\limits_{b}{\eta_{b}^{(k)}{z\left( {k,{i\left( {a,b} \right)}} \right)}}}}}}} & (10)\end{matrix}$

Since one has the bits of z(k,i(a,b)) in the clear, one can get theencryptions of the bits of ηhd b^((k))z(k,i(a,b)) by multiplying theciphertext for ηhd b^((k)) by either zero or one. The only real Z_(d)multiplications that are needed for implementation are themultiplications by the ηhda^((k)'s, and one only has O(p√{square root over (S)}) such multiplications for each q)_(k).

Note that there is a space-time tradeoff by choosing different values ofthe parameter c (i.e., the number of ciphertexts that are stored in thepublic key for every big set). One must choose c≧┌√{square root over(2S)}┐ to be able to encode any index iε[S] by a pair

${\left( {a,b} \right) \in \begin{pmatrix}C \\2\end{pmatrix}},$

but one can choose it even larger. Increasing c will increase the sizeof the public key accordingly, but decrease the number ofmultiplications that need to be computed when evaluating Equation (10).In particular, setting c=┌2√{square root over (S)}┐ increases the spacerequirements (over ┌√{square root over (2S)}┐) only by a √{square rootover (2)} factor, but cuts the number of multiplications in half.Accordingly, in this exemplary implementation use the settingc=┌2√{square root over (S)}┐.

10 Setting the Parameters

Table 2 shows the various parameters of the fully homomorphic scheme.The specific numeric values correspond to the three challenges.

TABLE 2 Parameter Meaning λ = 72 security parameter (Section 10.1) μ =2.34, 0.58, 0.15 BDD-hardness parameter (Section 10.1) s = 15 size ofthe sparse subset p = 4 precision parameter: number of bits for the z(k,i)′s d = 15 the degree of the squashed decryption polynomial t = 380bit-size of the coefficients of the generator polynomial v n = 2¹¹, 2¹³,2¹⁵ the dimension of the lattice S = 1024, 1024, 4096 size of the bigsets R = 2⁵¹, 2²⁰⁴, 2⁸⁵⁰ ratio between elements in the big sets

10.1 The Security Parameters λ and μ

There are two main security parameters that drive the choice of all theothers: one is a security parameter λ (that controls the complexity ofexhaustive-search/birthday attacks on the scheme), and the other is a“BDDP-hardness parameter” μ. More specifically, the parameter μquantifies the exponential hardness of the Shortest-Vector-Problem (SVP)and Bounded-Distance Decoding problems (BDDP) in lattices. Specifically,assume that for any k and (large enough) n, it takes time 2^(k) toapproximate SVP or BDDP in n-dimensional lattices (What is really beingassumed is that this hardness holds for the specific lattices thatresult from the scheme) to within a factor of

$2^{\frac{\mu \cdot n}{{k/\log}\; k}}.$

Use this specific form since it describes the asymptotic behavior of thebest algorithms for approximating SVP and BDDP (i.e., the ones based onblock reductions [14]).

One can make a guess as to the “true value” of μ by extrapolating fromthe results of Gama and Nguyen [2]: They reported achieving BDDPapproximation factors of 1.01^(n)≈2^(n/70) for “unique shortestlattices” in dimension n in the range of 100-400. Assuming that theirimplementation took ≈2⁴⁰ computation steps to compute, one has that μlog(40)/40≈ 1/70, which gives μ≈0.11.

For the challenges, however, start from larger values of μ,corresponding to stronger (maybe false) hardness assumptions.Specifically, the three challenges correspond to the three valuesμ≈2.17, μ≈10.54, and μ≈0.14. This makes it plausible that at least thesmaller challenges could be solved (once the lattice-reductiontechnology is adapted to lattices in dimensions of a few thousands). Forthe security parameter λ chose the moderate value λ=72. (This means thatthere may be birthday-type attacks on the scheme with complexity 2⁷², atleast in a model where each bignum arithmetic operation counts as asingle step.)

10.2 The Other Parameters

Once one has the parameters λ and μ, one can compute all the otherparameters of the system.

The Sparse-Subset Size s and Precision Parameter p.

The parameter that most influences this implementation is the size ofthe sparse subset. Asymptotically, this parameter can be made as smallas Θ(λ/log λ), so just set it to be λ/log λ, rounded up to the nextpower of two minus one. For λ=72 one has λ/log λ≈11.7, so set s=15.

Next determine the precision p that needs to be kept of the z(k,i)'s.Recall that for any element in any of the big sets x(k,i)εB_(k) setz(k,i) to be a p-bit-precision approximation of the rational number

c·x(k,i)

_(d)/d. To avoid rounding errors, one needs p to be at least ┌log(s+1)┐, so for s=15 one has p=4. This means that one represents eachz(k,i) with four bits of precision to the right of the binary digit, andone bit to the left of the binary digit (since after rounding one mayhave z(k,i)=1).

The Degree of Squashed Decryption.

Observe that using the grade-school algorithm for adding s=2^(p)−1integers, each with p bits of precision, the degree of the polynomialthat describes the carry bit to the p+1'th position is less than 2^(p).Specifically for the cases of s=15 and p=4, the degree of the carry bitis exactly 15. Table 3 shows carry propagation for grade-school additionof 15 numbers with four bits of precision. To see this, Table 3describes the carry bits that result from adding the bits in each of thefour columns to the right of the binary point (where one ignores carrybits beyond the first position to the left of the point):

-   -   The carry bit from column −4 to column −3 is a degree-2        polynomial in the bits of column −4, the carry bit to column −2        is a degree-4 polynomial, the carry bit to column −1 is a        degree-8 polynomial, and there are no more carry bits (since        only 15 bits are added).    -   The carry bit from column −3 to column −2 is a degree-2        polynomial in the bits of column −3, including the carry bit        from column −4. But since that carry bit is itself a degree-2        polynomial, then any term that includes that carry bit has        degree 3. Hence the total degree of the carry bit from column −3        to column −2 is 3. Similarly, the total degrees of the carry        bits from column −3 to columns −1, 0 are 5, 9, respectively        (since these are products of 4 and 8 bits, one of which has        degree 2 and all the others have degree 1).    -   By a similar argument every term in the carry from column −3 to        −2 is a product of two bits, but since column −3 includes two        carry bits of degrees 4 and 3, then their product has total        degree 7. Similarly, the carry to column 0 has total degree 9        (=4+3+1+1).    -   Repeating the same argument, one has that the total degree of        the carry bit from column −1 to columns 0 is 15 (=7+8).

It is concluded that the total degree of the grade-school additionalgorithm for this case is 15, but since one is using the space/degreetrade-off from Section 9.2 then every input to this algorithm is itselfa degree-2 polynomial, so one has total degree of 30 for thesquashed-decryption polynomial.

One can check that the number of degree-15 monomials in the polynomialrepresenting the grade-school addition algorithm is

${\begin{pmatrix}15 \\8\end{pmatrix} \times \begin{pmatrix}15 \\4\end{pmatrix} \times \begin{pmatrix}15 \\2\end{pmatrix} \times 15} \approx {2^{34}.}$

Also, every bit in the input of the grade-school addition algorithm isitself a sum of S bits, each of which is a degree-2 monomial in the bitsfrom the public key. Hence each degree-15 monomial in the grade-schooladdition polynomial corresponds to S¹⁵ degree-30 monomials in the bitsfrom the public key, and the entire decryption polynomial has 2³⁴×S¹⁵degree-30 monomials.

TABLE 3 columns: 0• −1 −2 −3 − 4 carry-degree from column −4: 8 4 2carry-degree from column −3: 9 5 3 carry-degree from column −2: 9 7carry-degree from column −1: 15 max degree: 15 8 4 2 1

The Bit-Size t of the Generating Polynomial.

Since one needs to support a product of two homomorphically-decryptedbits, then the scheme must support polynomials with 2⁶⁸·S³⁰ degree-60monomials. Recall from Section 5.2 that one chooses the noise in freshciphertexts with roughly 15-20 nonzero ±1 coefficients, and onemultiplies the noise by 2, so fresh ciphertexts have Euclidean norm ofroughly 2√{square root over (20)}≈9 . The experimental results fromSection 7 suggest that for a degree-60 polynomial with M terms one needsto set the bit-length parameter t large enough so that2^(t)≧c⁶⁰×√{square root over (M)} where c is slightly smaller than thenorm of fresh ciphertexts (e.g., c≈7 for sufficiently large values oft).

Therefore it is expected to be able to handle homomorphic-decryption(plus one more multiplication) if one sets t large enough so that2^(t−p)≧c⁶⁰·√{square root over (2⁶⁸·S³⁰)}. (Use 2^(t−p) rather than2^(t) since one needs the resulting ciphertext to be 2^(p) closer to thelattice than the decryption radium of the key, see Section 8.) For theconcrete parameters (p=4, S≦2048) one has the requirement2^(t−p)≧c⁶⁰·2^((68+11·30)/2)=c⁶⁰·2¹⁹⁹.

Using the experimental estimate c≈7 (so c⁶⁰≈2¹⁷⁰), this means that oneexpects to be able to handle bootstrapping for t≈170+199+4=373. Theexperiments confirm this expectation, in fact the experiments were ableto support homomorphic decryption of the product of two bits by settingthe bit-length parameter to t=380.

The Dimension n.

One needs to choose the dimension n large enough so that the achievableapproximation factor 2^(μn log λ/λ) is larger than the Minkowski boundfor the lattice (which is ≈2^(t)), so one needs n=λt/μ log λ. In thiscase t=380 and λ/log λ≈11.67, so choosing the dimension asnε{2¹¹,2¹³,2¹⁵} corresponds to the settings με{2.17,0.54,0.14},respectively.

Another way to look at the same numbers is to assume that the valueμ≈0.11 from the work of Gama and Nguyen [2] holds also in much higherdimensions, and deduce the complexity of breaking the scheme via latticereduction. For n=2048 one has λ/log λ=2048·0.11/380<1, which means thatthe small challenge should be readily breakable. Repeating thecomputations with this value of μ=0.11 for the medium and largechallenges yields λ≈6 and λ≈55, corresponding to complexity estimates of2⁶ and 2⁵⁵, respectively. Hence, if this estimate holds then even thelarge challenge may be feasibly breakable (albeit with significanteffort).

This “optimistic” view should be taken with a grain of salt, however,since there are significant polynomial factors that need to be accountedfor. It is expected that once these additional factors are incorporated,the large challenge will turn out to be practically secure, perhaps assecure as RSA-1024. It is hoped that the challenges will spur additionalresearch into the “true hardness” of lattice reduction in these highdimensions.

The Big-Set Size S.

One constraint on the size of the big sets is that birthday-typeexhaustive search attacks on the resulting SSSP problem should be hard.Such attacks take time S^(┌s/2┐), so one needs S^(┌s/2┐)≧2^(λ). For thesetting with λ=72, s=15, one needs S⁸≧2⁷², which means S≧512.

Another constraint on S is that it has to be large enough to thwartlattice attacks on the SSSP instance. The basic lattice-based attackconsists of putting all the s·S elements in all the big sets (denoted{x(k,i):k=1, . . . , s, i=1, . . . , S}) in the following matrix:

$B = \begin{pmatrix}1 & \; & \; & \; & \; & {x\left( {1,1} \right)} \\\; & 1 & \; & \; & \; & {x\left( {1,2} \right)} \\\; & \; & \ddots & \; & \; & \vdots \\\; & \; & \; & 1 & \; & {x\left( {s,S} \right)} \\\; & \; & \; & \; & 1 & {- w} \\\; & \; & \; & \; & \; & d\end{pmatrix}$

with w being the secret key of the somewhat homomorphic scheme (recallthat here is considered an attacker who knows w and tries to recover thesparse subset) and d being the determinant of the lattice (i.e., themodulus in the public key). Clearly, if σ_(1,1), . . . , σ_(s,S) are thebits of the secret key, then the lattice spanned by the rows of Bcontains the vector

σ_(1,1), . . . , σ_(s,S), 1, 0

, whose length is √{square root over (sS+1)}. To hide that vector, oneneeds to ensure that the BDDP approximation factor for this lattice islarger than the Minkowski bound for it, namely2^(μ(sS+2)log λ/λ)≧^(sS+2)√{square root over (d)}≈2^(tn/(sS+2)), whichis roughly equivalent to sS≧√{square root over (tnλ/μ log λ)}. Usings=15, t=380, λ=72 and the values of n and μ in the different dimensions,this gives the bounds S≧137 for the small challenge, S≧547 for themedium challenge, and S≧2185 for the large challenge.

Combining the two constraints, set S=512 for the small challenge, S=547for the medium challenge, and S=2185 for the large challenge.

The Ratio R Between Elements in the Big Sets.

Since “big sets” of a special type (i.e., geometric progressions mod d)are used, consider also a lattice attack that uses this special form.Namely, consider the lattice that includes only the first element ineach progression:

$B = \begin{pmatrix}1 & \; & \; & \; & \; & {x\left( {1,1} \right)} \\\; & 1 & \; & \; & \; & {x\left( {2,1} \right)} \\\; & \; & \ddots & \; & \; & \vdots \\\; & \; & \; & 1 & \; & {x\left( {s,1} \right)} \\\; & \; & \; & \; & 1 & {- w} \\\; & \; & \; & \; & \; & d\end{pmatrix}$

and use the fact that there is a combination of these x(i,1)'s withcoefficients at most R^(S−1) that yields the element w modulo d. R musttherefore be chosen large enough so that such combinations likely existfor many w's. This holds when R^(s(S−1))>d≈2^(nt). Namely, one needs logR>nt/sS. For the parameters in dimensions 2¹¹, 2¹³, 2¹⁵, one has

$R \geq {\frac{380}{15} \cdot \left\{ {\frac{2^{11}}{512},\frac{2^{13}}{547},\frac{2^{15}}{2185}} \right\}} \approx {\left\{ {102,381,381} \right\rbrack.}$

11 Performance

Table 3 shows parameters of the underlying somewhat-homomorphic scheme.

The bit-length of the determinant is |d|≈log₂d. Decryption time indimension 512 is below the precision of the measurements. Tables 4 and 5show parameters of the fully homomorphic scheme, as used for the publicchallenges.

TABLE 3 Dimen- bit- determinant sion n size t d keyGen Encrypt Decrypt512 380 | d | = 195764 0.32 sec 0.19 sec — 2048 380 | d | = 785006 1.2sec 1.8 sec 0.02 sec 8192 380 | d | = 3148249 10.6 sec 19 sec 0.13 sec32768 380 | d | = 12625500 3.2 min 3 min 0.66 sec

A strong contemporary machine was used to evaluate the performance ofthis implementation: It was run on an IBM System x3500 server, featuringa 64-bit quad-core Intel® Xeon® E5450 processor, running at 3 GHz, with12 MB L2 cache and 24 GB of RAM.

The implementation uses Shoup's NTL library [15] version 5.5.2 forhigh-level numeric algorithms, and GNU's GMP library [7] version 5.0.1for the underlying integer arithmetic operations. The code was compiledusing the gcc compiler (version 4.4.1) with compilation flagsgcc-O2-m64.

TABLE 4 Dimension bit- sparse-subset- big-set big-set n size t size ssize S ratio R 512 380 15 512 2²⁶  2048 380 15 512 2¹⁰² 8192 380 15 5472³⁸¹ 32768 380 15 2185 2³⁸¹

TABLE 5 Dimension bit- # of ctxts PK size n size t in PK (s · c) ≈s · c· | d | keyGen Recrypt 512 380 690 17 MByte 2.5 sec 6 sec 2048 380 69069 MByte 41 sec 32 sec 8192 380 705 284 MByte 8.4 min 2.8 min 32768 3801410 2.25 GByte 2.2 hour 31 min

The main results of the experiments are summarized in Tables 3 and 5,for the parameter-setting that was used to generate the publicchallenges [6]. Table 3 summarizes the main parameters of the underlyingsomewhat-homomorphic scheme. Recall that the public key of theunderlying scheme consists of two |d|-bit integers and the secret key isone |d|-bit integer, so the size of these keys range from 50/25 KB fordimension 512 up to 3/1.5 MB for dimension 32768.

Table 5 summarizes the main parameters of the fully homomorphic scheme.Note that most of the key-generation time is spent encrypting thesecret-key bits: indeed one can check that key generation time for apublic key with m ciphertexts takes roughly √{square root over (m)}longer than encryption of a single bit. (This is due to the batchencryption procedure from Section 5.1.)

Also note that 80-90% of the Recrypt time is spent adding the S numbersin each of the s big-sets, to come up with the final s numbers, and only10-20% of the time is spent on the grade-school addition of these finals numbers. Even with the optimization from Section 9.2, the vastmajority of that 80-90% is spent computing the multiplications fromEquation (10). For example, in dimension 32768 one computes a singleRecrypt operation in 31 minutes, of which 23 minutes are used to computethe multiplications from Equation (10), about 3.5 minutes are used tocompute the arithmetic progressions (which are used for the big sets),two more minutes for the additions from Equation (10), and the remaining2.5 minutes are spent doing grade-school addition.

REFERENCES

-   [1] R. M. Avanzi. Fast evaluation of polynomials with small    coefficients modulo an integer. Web document,    http://caccioppoli.mac.rub.de/website/papers/trick.pdf, 2005.-   [2] N. Gama and P. Q. Nguyen. Predicting lattice reduction. In    Advances in Cryptology—EUROCRYPT'08, volume 4965 of Lecture Notes in    Computer Science, pages 31-51. Springer, 2008.-   [3] C. Gentry. Fully homomorphic encryption using ideal lattices. In    STOC '09, pages 169-178 ACM, 2009.-   [4] C. Gentry. Toward basing fully homomorphic encryption on    worst-case hardness. In Advances in Cryptology—CRYPTO'10, volume    6223 of Lecture Notes in Computer Science, pages {.Springer, 2010.-   [5] Gentry, C., Halevi, S.: Implementing Gentry's Fully-Homomorphic    Encryption Scheme. Cryptology ePrint Archive, Report 2010/520    (2010). http://eprint.iacr.org/.-   [6] O. Goldreich, S. Goldwasser, and S. Halevi. Public-key    cryptosystems from lattice reduction problems. In Advances in    Cryptology—CRYPTO'97, volume 1294 of Lecture Notes in Computer    Science, pages 112 {131. Springer, 1997.-   [7] V. Lyubashevsky, C. Peikert, and O. Regev. On ideal lattices and    learning with errors over rings. In Advances in    Cryptology—EUROCRYPT'10, volume 6110 of Lecture Notes in Computer    Science, pages 1 {23. Springer, 2010.-   [8] D. Micciancio. Improving lattice based cryptosystems using the    hermite normal form. In CaLC'01, volume 2146 of Lecture Notes in    Computer Science, pages 126 {145. Springer, 2001.-   [9] Ogura, N., Yamamoto, G., Kobayashi, T., Uchiyama, S.: An    improvement of key generation algorithm for gentry's homomorphic    encryption scheme. In: Advances in Information and Computer    Security—5th International Workshop on Security, IWSEC 2010. Lecture    Notes in Computer Science, vol. 6434, pp. 70-83. Springer (2010).-   [10] M. S. Paterson and L. J. Stockmeyer. On the number of nonscalar    multiplications necessary to evaluate polynomials. SIAM Journal on    Computing, 2 (1):60 {66, 1973.-   [11] C. Peikert and A. Rosen. Lattices that admit logarithmic    worst-case to average-case connection factors. In Proceedings of the    39th Annual ACM Symposium on Theory of Computing {STOC'07, pages 478    {487. ACM, 2007.-   [12] R. Rivest, L. Adleman, and M. Dertouzos. On data banks and    privacy homomorphisms. In Foundations of Secure Computation, pages    169 {177. Academic Press, 1978.-   [13] N. P. Smart and F. Vercauteren. Fully homomorphic encryption    with relatively small key and ciphertext sizes. In Public Key    Cryptography—PKC'10, volume 6056 of Lecture Notes in Computer    Science, pages 420 {443. Springer, 2010.-   [14] D. Stehle and R. Steinfeld. Faster fully homomorphic    encryption. Cryptology ePrint Archive, Report 2010/299, 2010.    http://eprint.iacr.org/.-   [15] C. Gentry. A fully homomorphic encryption scheme. PhD thesis,    Stanford University, 2009. http://crypto.stanford.edu/craig.-   [16] C. Gentry and S. Halevi. Public Challenges for    Fully-Homomorphic Encryption. TBA, 2010.-   [17] The GNU Multiple Precision Arithmetic Library.    http://gmplib.org/, Version 5.0.1, 2010.-   [18] C.-P. Schnorr. A hierarchy of polynomial time lattice basis    reduction algorithms. Theor. Comput. Sci., 53:201 {224, 1987.-   [19] V. Shoup. NTL: A Library for doing Number Theory.    http://shoup.net/ntl/, Version 5.5.2, 2010.

Further Exemplary Embodiments

FIG. 1 illustrates a block diagram of an exemplary system in whichvarious exemplary embodiments of the invention may be implemented. Thesystem 100 may include at least one circuitry 102 (e.g., circuitryelement, circuitry components, integrated circuit) that may in certainexemplary embodiments include at least one processor 104. The system 100may also include at least one memory 106 (e.g., a volatile memorydevice, a non-volatile memory device), and/or at least one storage 108.The storage 108 may include a non-volatile memory device (e.g., EEPROM,ROM, PROM, RAM, DRAM, SRAM, flash, firmware, programmable logic, etc.),magnetic disk drive, optical disk drive and/or tape drive, asnon-limiting examples. The storage 108 may comprise an internal storagedevice, an attached storage device and/or a network accessible storagedevice, as non-limiting examples. The system 100 may include at leastone program logic 110 including code 112 (e.g., program code) that maybe loaded into the memory 106 and executed by the processor 104 and/orcircuitry 102. In certain exemplary embodiments, the program logic 110,including code 112, may be stored in the storage 108. In certain otherexemplary embodiments, the program logic 110 may be implemented in thecircuitry 102. Therefore, while FIG. 1 shows the program logic 110separately from the other elements, the program logic 110 may beimplemented in the memory 106 and/or the circuitry 102, as non-limitingexamples.

The system 100 may include at least one communications component 114that enables communication with at least one other component, system,device and/or apparatus. As non-limiting examples, the communicationscomponent 114 may include a transceiver configured to send and receiveinformation, a transmitter configured to send information and/or areceiver configured to receive information. As a non-limiting example,the communications component 114 may comprise a modem or network card.The system 100 of FIG. 1 may be embodied in a computer or computersystem, such as a desktop computer, a portable computer or a server, asnon-limiting examples. The components of the system 100 shown in FIG. 1may be connected or coupled together using one or more internal buses,connections, wires and/or (printed) circuit boards, as non-limitingexamples.

It should be noted that in accordance with the exemplary embodiments ofthe invention, one or more of the circuitry 102, processor(s) 104,memory 106, storage 108, program logic 110 and/or communicationscomponent 114 may store one or more of the various items (e.g.,public/private key(s), ciphertexts, encrypted items, matrices,variables, equations, formula, operations, operational logic, logic)discussed herein. As a non-limiting example, one or more of theabove-identified components may receive and/or store the information(e.g., to be encrypted, resulting from decryption) and/or the ciphertext(e.g., to be decrypted, to be operated on homomorphically, resultingfrom encryption). As a further non-limiting example, one or more of theabove-identified components may receive and/or store the encryptionfunction(s) and/or the decryption function(s), as described herein.

The exemplary embodiments of this invention may be carried out bycomputer software implemented by the processor 104 or by hardware, or bya combination of hardware and software. As a non-limiting example, theexemplary embodiments of this invention may be implemented by one ormore integrated circuits. The memory 106 may be of any type appropriateto the technical environment and may be implemented using anyappropriate data storage technology, such as optical memory devices,magnetic memory devices, semiconductor-based memory devices, fixedmemory and removable memory, as non-limiting examples. The processor 104may be of any type appropriate to the technical environment, and mayencompass one or more of microprocessors, general purpose computers,special purpose computers and processors based on a multi-corearchitecture, as non-limiting examples.

Below are further descriptions of various non-limiting, exemplaryembodiments of the invention. Some of the below-described exemplaryembodiments are numbered separately for purposes of clarity. Thisnumbering should not be construed as entirely separating the variousexemplary embodiments since aspects of one or more exemplary embodimentsmay be practiced in conjunction with one or more other aspects orexemplary embodiments.

Building on section 5.1, it is noted that standard polynomial evaluationusing Horner's rule takes n multiplications to implement for a degree-npolynomial. It is known that for small coefficients this can be reducedto only O(√{square root over (n)}) multiplications. This hasapplications in many areas, and, in particular, is useful forimplementing Gentry's fully-homomorphic encryption (e.g., in conjunctionwith bootstrapping). Other applications that require evaluation ofsmall-coefficient polynomials arise in elliptic-curve cryptography, forexample, see [1]. However, if the need arises to evaluate manypolynomials then one must pay the O(√{square root over (n)}) complexitycost for each one.

In this context, if t bits are used to represent a point then anythingless than 2^(√{square root over (t)}) would be considered “small.” Thecoefficients have to be much smaller than the point at which thepolynomial is evaluated.

One exemplary embodiment of the invention enables a reduction in thiscomplexity cost. In such a manner, evaluating k polynomials of degree n(with small coefficients) can be done with only O(√{square root over(kn)}) multiplications. When the number (k) of polynomials is large,this offers a significant speedup in operations.

(1) In one exemplary embodiment of the invention, and as shown in FIG.2, a method for evaluating at a point r one or more polynomials p₁(x), .. . , p_(l)(x) of maximum degree up to n−1, where for every i thepolynomial p_(i)(x) has a degree of exactly t_(i)−1, the methodcomprising: partitioning (e.g., by an apparatus, by at least oneprocessor, by at least one processing component, by at least oneintegrated circuit, by hardware) each polynomial p_(i)(x) into a bottomhalf p_(i) ^(bot)(x) consisting of bottom terms with lowest s_(i)coefficients and a top half p_(i) ^(top)(x) consisting of top terms withremaining t_(i)−s_(i) coefficients, where n and 1 are integers greaterthan zero, where for every i, t_(i) and s_(i) are integers greater thanzero (201); recursively partitioning (e.g., by the apparatus) the bottomhalf p_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms (202); evaluating (e.g., by theapparatus) the bottom half p_(i) ^(bot)(x) and the top half p_(i)^(top)(x) at the point r for each polynomial p_(i)(x) by evaluating theplurality of partitioned terms at the point r and iteratively combiningthe evaluated partitioned terms (203); and evaluating (e.g., by theapparatus) each polynomial p_(i)(x) at the point r by settingp_(i)(r)=r^(s) ^(i) p_(i) ^(top)(r)+p_(i) ^(bot)(r) (204).

A method as above, where recursively partitioning the bottom half p_(i)^(bot)(x) and the top half p_(i) ^(top)(x) of each polynomial p_(i)(x)comprises iteratively doubling a number of terms while reducing a degreeof the terms by half. A method as in any above, where the at least onecondition is with respect to a current number of polynomial terms k anda current maximal degree m of the polynomial terms, where powers of rare expressed as r, r², r³, . . . , r^(m), where in response to the atleast one condition being met all the powers of r up to the currentmaximal degree m of the polynomial terms are computed and all of thepolynomial terms are evaluated by adding up all of the powers of rmultiplied by their respective coefficients: p_(i)(r)=Σ_(r=0)^(r=m)p_(ij)r^(j), where for every i and j, p_(ij) is the coefficient ofr^(j) in the polynomial p_(i)(x). A method as in any above, where the atleast one condition is with respect to a current number of polynomialterms k and a current maximal degree m of the polynomial terms, wherethe at least one condition comprises the current number of polynomialterms k being larger than half of the current maximal degree m:

$k > {\frac{m}{2}.}$

A method as in any above, where for every i,

${s_{i} = \frac{n}{2}},$

rounded to an integer.

A method as in any above, where iteratively combining the evaluatedpartitioned terms is performed until evaluations of the bottom halfp_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) at the point r areobtained. A method as in any above, where the method is utilized inconjunction with encryption of at least one bit. A method as in anyabove, further comprising: obtaining (e.g., by the apparatus) one ormore ciphertext results by multiplying the evaluation of each of the oneor more polynomials p₁(x), . . . , p_(l)(x) at the point r by two andfor every i adding a bit b_(i).

A computer program comprising machine readable instructions which whenexecuted by an apparatus control it to perform the method as in any oneof the preceding claims. A method as in any above, implemented as acomputer program. A method as in any above, implemented as a program ofinstructions stored (e.g., tangibly embodied) on a program storagedevice (e.g., at least one memory, at least one computer-readablemedium) and executable by a computer (e.g., at least one processor). Amethod as in any above, further comprising one or more aspects of theexemplary embodiments of the invention as described further herein.

(2) In another exemplary embodiment of the invention, and as shown inFIG. 2, a computer readable storage medium (e.g., a memory, at least onememory, non-transitory) tangibly embodying a program of instructionsexecutable by a machine (e.g., a processor, at least one processor, acomputer) for performing operations for evaluating at a point r one ormore polynomials p₁(x), . . . , p_(l)(x) of maximum degree up to n−1,where for every i the polynomial p_(i)(x) has a degree of exactlyt_(i)−1, the operations comprising: partitioning each polynomialp_(i)(x) into a bottom half p_(i) ^(bot)(x) consisting of bottom termswith lowest s_(i) coefficients and a top half p_(i) ^(top)(x) consistingof top terms with remaining t_(i)−s_(i) coefficients, where n and l areintegers greater than zero, where for every i, t_(i) and s_(i) areintegers greater than zero (201); recursively partitioning the bottomhalf p_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms (202); evaluating the bottom half p_(i)^(bot)(x) and the top half p_(i) ^(top)(x) at the point r for eachpolynomial p_(i)(x) by evaluating the plurality of partitioned terms atthe point r and iteratively combining the evaluated partitioned terms(203); and evaluating each polynomial p_(i)(x) at the point r by settingp_(i)(r)=r^(s) ^(i) p_(i) ^(top)(r)+p_(i) ^(bot)(r) (204).

A computer readable storage medium as in any above, further comprisingone or more additional aspects of the exemplary embodiments of theinvention as described herein.

(3) In a further exemplary embodiment of the invention, an apparatus forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, the apparatus comprising: at least onememory configured to store the one or more polynomials p₁(x), . . . ,p_(l)(x), where for every i the polynomial p_(i)(x) has a degree ofexactly t_(i)−1; and at least one processor configured to partition eachpolynomial p_(i)(x) into a bottom half p_(i) ^(bot)(x) consisting ofbottom terms with lowest s_(i) coefficients and a top half p_(i)^(top)(x) consisting of top terms with remaining t_(i)−s_(i)coefficients, where n and l are integers greater than zero, where forevery i, t_(i) and s_(i) are integers greater than zero (201);recursively partition the bottom half p_(i) ^(bot)(x) and the top halfp_(i) ^(top)(x) of each polynomial p_(i)(x) to obtain further termshaving a lower degree than previous terms, where the recursivepartitioning is performed until at least one condition is met at whichpoint the recursive partitioning yields a plurality of partitioned terms(202); evaluate the bottom half p_(i) ^(bot)(x) and the top half p_(i)^(top)(x) at the point r for each polynomial p_(i)(x) by evaluating theplurality of partitioned terms at the point r and iteratively combiningthe evaluated partitioned terms (203); and evaluate each polynomialp_(i)(x) at the point r by setting p_(i)(r)=r^(s) ^(i) p_(i)^(top)(r)+p_(i) ^(bot)(r) (204).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(4) In another exemplary embodiment of the invention, an apparatus forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, where for every i the polynomial p_(i)(x)has a degree of exactly t_(i)−1, the apparatus comprising: means forpartitioning each polynomial p_(i)(x) into a bottom half p_(i) ^(bot)(x)consisting of bottom terms with lowest s_(i) coefficients and a top halfp_(i) ^(top)(x) consisting of top terms with remaining t_(i)−s_(i)coefficients, where n and l are integers greater than zero, where forevery i, t_(i) and s_(i) are integers greater than zero; means forrecursively partitioning the bottom half p_(i) ^(bot)(x) and the tophalf p_(i) ^(top)(x) of each polynomial p_(i)(x) to obtain further termshaving a lower degree than previous terms, where the recursivepartitioning is performed until at least one condition is met at whichpoint the recursive partitioning yields a plurality of partitionedterms; means for evaluating the bottom half p_(i) ^(bot)(x) and the tophalf p_(i) ^(top)(x) at the point r for each polynomial p_(i)(x) byevaluating the plurality of partitioned terms at the point r anditeratively combining the evaluated partitioned terms; and means forevaluating each polynomial p_(i)(x) at the point r by settingp_(i)(r)=r^(s) ^(i) p_(i) ^(top)(r)+p_(i) ^(bot)(r).

An apparatus as above, further comprising means for storing the one ormore polynomials p₁(x), . . . , p_(l)(x). An apparatus as in any above,where the means for storing comprises at least one storage medium,memory or memory medium. An apparatus as in any above, where the meansfor partitioning, means for recursively partitioning, means forevaluating the bottom half p_(i) ^(bot)(x) and the top half p_(i)^(top)(x) and means for evaluating each polynomial p_(i)(x) comprise atleast one processor, at least one processing component, at least onecircuit or at least one integrated circuit. An apparatus as in anyabove, further comprising one or more additional aspects of theexemplary embodiments of the invention as described herein.

(5) In a further exemplary embodiment of the invention, an apparatus forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, where for every i the polynomial p_(i)(x)has a degree of exactly t_(i)−1, the apparatus comprising: firstcircuitry (e.g., partitioning circuitry, first processing circuitry)configured to partition each polynomial p_(i)(x) into a bottom halfp_(i) ^(bot)(x) consisting of bottom terms with lowest s_(i)coefficients and a top half p_(i) ^(top)(x) consisting of top terms withremaining t_(i)−s_(i) coefficients, where n and l are integers greaterthan zero, where for every i, t_(i) and s_(i) are integers greater thanzero; second circuitry (e.g., recursive partitioning circuitry, secondprocessing circuitry) configured to recursively partition the bottomhalf p_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms; third circuitry (e.g., first evaluationcircuitry, third processing circuitry) configured to evaluate the bottomhalf p_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) at the point r foreach polynomial p_(i)(x) by evaluating the plurality of partitionedterms at the point r and iteratively combining the evaluated partitionedterms; and fourth circuitry (e.g., second evaluation circuitry, fourthprocessing circuitry) configured to evaluate each polynomial p_(i)(x) atthe point r by setting p_(i)(r)=r^(s) ^(i) p_(i) ^(top)(r)+p_(i)^(bot)(r).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(6) In another exemplary embodiment of the invention, and as shown inFIG. 3, a method for evaluating at a point r one or more polynomialsp₁(x), . . . , p_(l)(x) of maximum degree up to n−1, where for every ithe polynomial p_(i)(x) has a degree of exactly t_(i)−1, the methodcomprising: partitioning (e.g., by an apparatus, by at least oneprocessor, by at least one processing component, by at least oneintegrated circuit, by hardware) each polynomial p_(i)(x) into a_(i)parts p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . , p_(i) ^((a) ^(i) ⁾(x), wherefor each i and j the part p_(i) ^((j))(x) consists of a differentsequential portion of the t_(i) coefficients of the polynomial p_(i)(x),where n is an integer greater than zero, where for every i, a_(i), andt_(i) are integers greater than zero (301); recursively partitioning(e.g., by the apparatus) each part p_(i) ^((j))(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms (302); evaluating (e.g., by theapparatus) each part p_(i) ^((j))(x) at the point r for each polynomialp_(i)(x) by evaluating the plurality of partitioned terms at the point rand iteratively combining the evaluated partitioned terms (303); andevaluating (e.g., by the apparatus) each polynomial p_(i)(x) at thepoint r by setting p_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y) ^(ij) p_(i)^((j))(r), where for every i, y_(ij) is a total number of coefficientsin all of the parts from 1 to j−1: p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . ,p_(i) ^((j−1))(x) (304).

A method as in any above, where a_(i)=2 for all i. A method as in anyabove, where a_(i)>2 for some i. A method as in any above, whererecursively partitioning each part p_(i) ^((j))(x) of each polynomialp_(i)(x) comprises iteratively doubling a number of terms while reducinga degree of the terms by half. A method as in any above, where the atleast one condition is with respect to a current number of polynomialterms k and a current maximal degree m of the polynomial terms, wherepowers of r are expressed as r, r², r³, . . . , r^(m), where in responseto the at least one condition being met all the powers of r up to thecurrent maximal degree m of the polynomial terms are computed and all ofthe polynomial terms are evaluated by adding up all of the powers of rmultiplied by their respective coefficients: p_(i)(r)=Σ_(r=0)^(r=m)p_(ij)r^(j), where for every i and j, p_(ij) is the coefficient ofr^(j) in the polynomial p_(i)(x). A method as in any above, where the atleast one condition is with respect to a current number of polynomialterms k and a current maximal degree m of the polynomial terms, wherethe at least one condition comprises the current number of polynomialterms k being larger than half of the current maximal degree m:

$k > {\frac{m}{2}.}$

A method as in any above, where iteratively combining the evaluatedpartitioned terms comprises iteratively combining lowest powers of theevaluated partitioned terms to obtain higher power terms. A method as inany above, where iteratively combining the evaluated partitioned termsis performed until evaluations of each part p_(i) ^((j))(x) at the pointr are obtained. A method as in any above, further comprising: obtainingat least one ciphertext result by multiplying the evaluation of eachpolynomial p_(i)(x) at the point r by two and for every i adding a bitb_(i).

A computer program comprising machine readable instructions which whenexecuted by an apparatus control it to perform the method as in any oneof the preceding. A method as in any above, implemented as a computerprogram. A method as in any above, implemented as a program ofinstructions stored (e.g., tangibly embodied) on a program storagedevice (e.g., at least one memory, at least one computer-readablemedium) and executable by a computer (e.g., at least one processor). Amethod as in any above, further comprising one or more aspects of theexemplary embodiments of the invention as described further herein.

(7) In a further exemplary embodiment of the invention, and as shown inFIG. 2, a computer readable storage medium (e.g., a memory, at least onememory, non-transitory) tangibly embodying a program of instructionsexecutable by a machine (e.g., a processor, at least one processor, acomputer) for performing operations for evaluating at a point r one ormore polynomials p₁(x), . . . , p_(l)(x) of maximum degree up to n−1,where for every i the polynomial p_(i)(x) has a degree of exactlyt_(i)−1, the operations comprising: partitioning each polynomialp_(i)(x) into a_(i) parts p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . , p_(i)^((a) ^(i) ⁾(x), where for each i and j the part p_(i) ^((j))(x)consists of a different sequential portion of the t_(i) coefficients ofthe polynomial p_(i)(x), where n is an integer greater than zero, wherefor every i, a_(i), and t_(i) are integers greater than zero (301);recursively partitioning each part p_(i) ^((j))(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms (302); evaluating each part p_(i)^((j))(x) at the point r for each polynomial p_(i)(x) by evaluating theplurality of partitioned terms at the point r and iteratively combiningthe evaluated partitioned terms (303); and evaluating each polynomialp_(i)(x) at the point r by setting p_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y)^(ij) p_(i) ^((j))(r), where for every i, y_(ij) is a total number ofcoefficients in all of the parts from 1 to j−1: p_(i) ⁽¹⁾(x), p_(i)⁽²⁾(x), . . . , p_(i) ^((j−1))(x) (304).

A computer readable storage medium as in any above, further comprisingone or more additional aspects of the exemplary embodiments of theinvention as described herein.

(8) In another exemplary embodiment of the invention, an apparatus forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, the apparatus comprising: at least onememory configured to store the one or more polynomials p₁(x), . . . ,p_(l)(x), where for every i the polynomial p_(i)(x) has a degree ofexactly t_(i)−1; and at least one processor configured to partition eachpolynomial p_(i)(x) into a_(i) parts p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . ,p_(i) ^((a) ^(i) ⁾(x), where for each i and j the part p_(i) ^((j))(x)consists of a different sequential portion of the t_(i) coefficients ofthe polynomial p_(i)(x), where n is an integer greater than zero, wherefor every i, a_(i), and t_(i) are integers greater than zero;recursively partition each part p_(i) ^((j))(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms; evaluate each part p_(i) ^((j))(x) atthe point r for each polynomial p_(i)(x) by evaluating the plurality ofpartitioned terms at the point r and iteratively combining the evaluatedpartitioned terms; and evaluate each polynomial p_(i)(x) at the point rby setting p_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y) ^(ij) p_(i) ^((j))(r), wherefor every i, y_(ij) is a total number of coefficients in all of theparts from 1 to j−1: p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . , p_(i)^((j−1))(x).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(9) In a further exemplary embodiment of the invention, an apparatus forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, where for every i the polynomial p_(i)(x)has a degree of exactly t_(i)−1, the apparatus comprising: means forpartitioning each polynomial p_(i)(x) into a_(i) parts p_(i) ⁽¹⁾(x),p_(i) ⁽²⁾(x), . . . , p_(i) ^((a) ^(i) ⁾(x), where for each i and j thepart p_(i) ^((j))(x) consists of a different sequential portion of thet_(i) coefficients of the polynomial p_(i)(x), where n is an integergreater than zero, where for every i, a_(i), and t_(i) are integersgreater than zero; means for recursively partitioning each part p_(i)^((j))(x) of each polynomial p_(i)(x) to obtain further terms having alower degree than previous terms, where the recursive partitioning isperformed until at least one condition is met at which point therecursive partitioning yields a plurality of partitioned terms; meansfor evaluating each part p_(i) ^((j))(x) at the point r for eachpolynomial p_(i)(x) by evaluating the plurality of partitioned terms atthe point r and iteratively combining the evaluated partitioned terms;and means for evaluating each polynomial p_(i)(x) at the point r bysetting p_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y) ^(ij) p_(i) ^((j))(r), wherefor every i, y_(ij) is a total number of coefficients in all of theparts from 1 to j−1: p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . , p_(i)^((j−1))(x).

An apparatus as above, further comprising means for storing the one ormore polynomials p₁(x), . . . , p_(l)(x). An apparatus as in any above,where the means for storing comprises at least one storage medium,memory or memory medium. An apparatus as in any above, where the meansfor partitioning, means for recursively partitioning, means forevaluating each part p_(i) ^((j))(x) and means for evaluating eachpolynomial p_(i)(x) comprise at least one processor, at least oneprocessing component, at least one circuit or at least one integratedcircuit. An apparatus as in any above, further comprising one or moreadditional aspects of the exemplary embodiments of the invention asdescribed herein.

(10) In another exemplary embodiment of the invention, an apparatus forevaluating at a point r one or more polynomials p₁(x), . . . , p_(l)(x)of maximum degree up to n−1, where for every i the polynomial p_(i)(x)has a degree of exactly t_(i)−1, the apparatus comprising: firstcircuitry (e.g., partitioning circuitry, first processing circuitry)configured to partition each polynomial p_(i)(x) into a_(i) parts p_(i)⁽¹⁾(x), p_(i) ⁽²)(x), . . . , p_(i) ^((a) ^(i) ⁾(x), where for each iand j the part p_(i) ^((j))(x) consists of a different sequentialportion of the t_(i) coefficients of the polynomial p_(i)(x), where n isan integer greater than zero, where for every i, a_(i), and t_(i) areintegers greater than zero; second circuitry (e.g., recursivepartitioning circuitry, second processing circuitry) configured torecursively partition each part p_(i) ^((j))(x) of each polynomialp_(i)(x) to obtain further terms having a lower degree than previousterms, where the recursive partitioning is performed until at least onecondition is met at which point the recursive partitioning yields aplurality of partitioned terms; third circuitry (e.g., first evaluationcircuitry, third processing circuitry) configured to evaluate each partp_(i) ^((j))(x) at the point r for each polynomial p_(i)(x) byevaluating the plurality of partitioned terms at the point r anditeratively combining the evaluated partitioned terms; and fourthcircuitry (e.g., second evaluation circuitry, fourth processingcircuitry) configured to evaluate each polynomial p_(i)(x) at the pointr by setting p_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y) ^(ij) p_(i) ^((j))(r),where for every i, y_(ij) is a total number of coefficients in all ofthe parts from 1 to j−1: p_(i) ⁽¹⁾(x), p_(i) ⁽²⁾(x), . . . , p_(i)^((j−1))(x).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(11) In a further exemplary embodiment of the invention, and as shown inFIG. 4, a method for evaluating at a point one or more polynomials,comprising: starting with a current number of current polynomials havinga current maximal degree, recursively partitioning (e.g., by anapparatus, by at least one processor, by at least one processingcomponent, by at least one integrated circuit, by hardware) the currentpolynomials to double the current number of current polynomials whilereducing the current maximal degree of the current polynomials by half(401); in response to the current maximal degree meeting at least onecondition, evaluating (e.g., by the apparatus) the current polynomialsto obtain a plurality of partial results (402); and obtaining (e.g., bythe apparatus) a total evaluation for the one or more polynomials at thepoint by recombining the plurality of partial results into polynomialsin reverse order from the recursive partitioning (403).

A method as in any above, where recursively partitioning the currentpolynomials comprises iteratively doubling a number of polynomials whilereducing a maximum degree of the polynomials by half. A method as in anyabove, where the at least one condition is with respect to the currentnumber of current polynomials and the current maximal degree. A methodas in any above, where the at least one condition is with respect to thecurrent number of current polynomials and the current maximal degree,where the at least one condition comprises the current number of currentpolynomials being larger than half of the current maximal degree.

A computer program comprising machine readable instructions which whenexecuted by an apparatus control it to perform the method as in any oneof the preceding. A method as in any above, implemented as a computerprogram. A method as in any above, implemented as a program ofinstructions stored (e.g., tangibly embodied) on a program storagedevice (e.g., at least one memory, at least one computer-readablemedium) and executable by a computer (e.g., at least one processor). Amethod as in any above, further comprising one or more aspects of theexemplary embodiments of the invention as described further herein.

(12) In another exemplary embodiment of the invention, and as shown inFIG. 4, a computer readable storage medium (e.g., a memory, at least onememory, non-transitory) tangibly embodying a program of instructionsexecutable by a machine (e.g., a processor, at least one processor, acomputer) for performing operations for evaluating at a point one ormore polynomials, the operations comprising: starting with a currentnumber of current polynomials having a current maximal degree,recursively partitioning the current polynomials to double the currentnumber of current polynomials while reducing the current maximal degreeof the current polynomials by half (401); in response to the currentmaximal degree meeting at least one condition, evaluating the currentpolynomials to obtain a plurality of partial results (402); andobtaining a total evaluation for the one or more polynomials at thepoint by recombining the plurality of partial results into polynomialsin reverse order from the recursive partitioning (403).

A computer readable storage medium as in any above, further comprisingone or more additional aspects of the exemplary embodiments of theinvention as described herein.

(13) In a further exemplary embodiment of the invention, an apparatusfor evaluating at a point one or more polynomials, comprising: at leastone memory configured to store the one or more polynomials; and at leastone processor configured, starting with a current number of currentpolynomials having a current maximal degree (e.g., the one or morepolynomials), to recursively partition the current polynomials to doublethe current number of current polynomials while reducing the currentmaximal degree of the current polynomials by half; in response to thecurrent maximal degree meeting at least one condition, to evaluate thecurrent polynomials to obtain a plurality of partial results; and toobtain a total evaluation for the one or more polynomials at the pointby recombining the plurality of partial results into polynomials inreverse order from the recursive partitioning.

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(14) In another exemplary embodiment of the invention, an apparatus forevaluating at a point one or more polynomials, comprising: means,starting with a current number of current polynomials having a currentmaximal degree, for recursively partitioning the current polynomials todouble the current number of current polynomials while reducing thecurrent maximal degree of the current polynomials by half; means, inresponse to the current maximal degree meeting at least one condition,for evaluating the current polynomials to obtain a plurality of partialresults; and means for obtaining a total evaluation for the one or morepolynomials at the point by recombining the plurality of partial resultsinto polynomials in reverse order from the recursive partitioning.

An apparatus as above, further comprising means for storing the one ormore polynomials. An apparatus as in any above, where the means forstoring comprises at least one storage medium, memory or memory medium.An apparatus as in any above, where the means for recursivelypartitioning, means for evaluating and means for obtaining comprise atleast one processor, at least one processing component, at least onecircuit or at least one integrated circuit. An apparatus as in anyabove, further comprising one or more additional aspects of theexemplary embodiments of the invention as described herein.

(15) In a further exemplary embodiment of the invention, an apparatusfor evaluating at a point one or more polynomials, comprising: firstcircuitry (e.g., partitioning circuitry, first processing circuitry)configured, starting with a current number of current polynomials havinga current maximal degree, to recursively partition the currentpolynomials to double the current number of current polynomials whilereducing the current maximal degree of the current polynomials by half;second circuitry (e.g., evaluation circuitry, second processingcircuitry) configured, in response to the current maximal degree meetingat least one condition, to evaluate the current polynomials to obtain aplurality of partial results; and third circuitry (e.g., obtainingcircuitry, third processing circuitry) configured to obtaining a totalevaluation for the one or more polynomials at the point by recombiningthe plurality of partial results into polynomials in reverse order fromthe recursive partitioning.

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

Building on section 4, consider an integer polynomial v(x) modulo apolynomial f_(n)(x) of the form f_(n)(x)=x^(n)±1, where n is a power of2. Arithmetic modulo polynomials of this form are often a convenient wayto realize mathematical structures. As a non-limiting example, theyprovide an efficient technique for implementing Gentry'sfully-homomorphic encryption scheme. Previous solutions computed theentire inverse polynomial, there was no provision for computing only asingle coefficient, for example. Exemplary embodiments of this inventionenable computation of only the desired coefficient(s) (e.g., less thanthe entire inverse), and, thus, provide savings in solution time,complexity and processing.

Another exemplary embodiment of the invention provides an algorithm forcomputing (at least) one coefficient of the inverse polynomial w*(x)modulo f_(n)(x) in time (n·poly log n), where

${w^{*}(x)} = {\frac{1}{v(x)} = {{v^{- 1}(x)}.}}$

The algorithm also may compute the resultant of the input polynomialsv(x) and f_(n)(x).

(16) In another exemplary embodiment of the invention, and as shown inFIG. 5, a method for computing a resultant and a free term of a scaledinverse of a first polynomial v(x) modulo a second polynomial f_(n)(x),comprising: receiving (e.g., by an apparatus, by at least one processor,by at least one processing component, by at least one integratedcircuit, by hardware) the first polynomial v(x) modulo the secondpolynomial f_(n)(x), where the second polynomial is of a formf_(n)(x)=x^(n)±1, where n=2^(k) and k is an integer greater than 0(501); computing (e.g., by the apparatus) lowest two coefficients of athird polynomial g(z) that is a function of the first polynomial and thesecond polynomial, where

${{g(z)}\overset{def}{=}{\prod\limits_{i = 0}^{n - 1}\left( {{v\left( \rho_{i} \right)} - z} \right)}},$

where ρ₀, ρ₁, . . . , ρ_(n−1) are roots of the second polynomialf_(n)(x) over a field (502); outputting (e.g., by the apparatus) thelowest coefficient of g(z) as the resultant (503); and outputting (e.g.,by the apparatus) the second lowest coefficient of g(z) divided by n asthe free term of the scaled inverse of the first polynomial v(x) modulothe second polynomial f_(n)(x).

A method as in any above, where computing the lowest two coefficients ofthe third polynomial g(z) comprises computing a fourth polynomial h(z),where h(z)=g(z)mod z². A method as in any above, where computing thefourth polynomial h(z)=g(z)mod z² comprises computing pairs ofpolynomials U_(j)(x) and V_(j)(x) for j=0, 1, . . . , log n, such thatfor all j it holds that g(z) is congruent modulo z² to a fifthpolynomial G_(j)(z), where

${G_{j}(z)}\overset{def}{=}{\prod\limits_{i = 0}^{\frac{n}{2^{j}}}{\left( {{V_{j}\left( \rho_{i}^{2^{j}} \right)} - {{zU}_{j}\left( \rho_{i}^{2^{j}} \right)}} \right).}}$

A method as in any above, where for every j the polynomials U_(j+1)(x²)and V_(j+1)(x²) are defined as:

${U_{j + 1}\left( x^{2} \right)}\overset{def}{=}{{{U_{j}(x)}{V_{j}\left( {- x} \right)}} + {{U_{j}\left( {- x} \right)}{V_{j}(x)}{{mod}\left( {x^{\frac{n}{2^{j}}} \pm 1} \right)}\mspace{14mu} {and}}}$${V_{j + 1}\left( x^{2} \right)}\overset{def}{=}{{V_{j}(x)}{V_{j}\left( {- x} \right)}{{{mod}\left( {x^{\frac{n}{2^{j}}} \pm 1} \right)}.}}$

A method as in any above, where the first polynomial v(x) modulo thesecond polynomial f_(n)(x) is derived from a sixth polynomial u(x) suchthat v(x)=x^(i). u(x)mod f_(n)(x), where i is an integer less than n:i<n. A method as in any above, where the free term of the scaled inverseof the first polynomial v(x) modulo the second polynomial f_(n)(x)comprises the i-th coefficient of the scaled inverse of u(x). A methodas in any above, where the free term of the scaled inverse of the firstpolynomial v(x) modulo the second polynomial f_(n)(x) is used as aprivate key for decryption of a ciphertext. A method as in any above,where the field is (comprises) a complex field. A method as in anyabove, where the field is (comprises) a finite field. A method as in anyabove, where the field is (comprises) a complex field or a finite field.

A computer program comprising machine readable instructions which whenexecuted by an apparatus control it to perform the method as in any oneof the preceding. A method as in any above, implemented as a computerprogram. A method as in any above, implemented as a program ofinstructions stored (e.g., tangibly embodied) on a program storagedevice (e.g., at least one memory, at least one computer-readablemedium) and executable by a computer (e.g., at least one processor). Amethod as in any above, further comprising one or more aspects of theexemplary embodiments of the invention as described further herein.

(17) In a further exemplary embodiment of the invention, and as shown inFIG. 5, a computer readable storage medium (e.g., a memory, at least onememory, non-transitory) tangibly embodying a program of instructionsexecutable by a machine (e.g., a processor, at least one processor, acomputer) for performing operations for computing a resultant and a freeterm of a scaled inverse of a first polynomial v(x) modulo a secondpolynomial f_(n)(x), the operations comprising: receiving the firstpolynomial v(x) modulo the second polynomial f_(n)(x), where the secondpolynomial is of a form f_(n)(x)=x^(n)±1, where n=2^(k) and k is aninteger greater than 0 (501); computing lowest two coefficients of athird polynomial g(z) that is a function of the first polynomial and thesecond polynomial, where

${{g(z)}\overset{def}{=}{\prod\limits_{i = 0}^{n - 1}\left( {{v\left( \rho_{i} \right)} - z} \right)}},$

where ρ₀, ρ₁, . . . , ρ_(n−1) are roots of the second polynomialf_(n)(x) over a field (502); outputting the lowest coefficient of g(z)as the resultant (503); and outputting the second lowest coefficient ofg(z) divided by n as the free term of the scaled inverse of the firstpolynomial v(x) modulo the second polynomial f_(n)(x).

A computer readable storage medium as in any above, further comprisingone or more additional aspects of the exemplary embodiments of theinvention as described herein.

(18) In another exemplary embodiment of the invention, an apparatuscomprising: at least one storage medium configured to store a firstpolynomial v(x) modulo a second polynomial f_(n)(x), where the secondpolynomial is of a form f_(n)(x)=x^(n)±1, where n=2^(k) and k is aninteger greater than 0; and at least one processor configured to computea resultant and a free term of a scaled inverse of the first polynomialv(x) modulo the second polynomial f_(n)(x) by computing lowest twocoefficients of a third polynomial g(z) that is a function of the firstpolynomial and the second polynomial, where

${{g(z)}\overset{def}{=}{\prod\limits_{i = 0}^{n - 1}\left( {{v\left( \rho_{i} \right)} - z} \right)}},$

where ρ₀, ρ₁, . . . , ρ_(n−1) are roots of the second polynomialf_(n)(x) over a field; outputting the lowest coefficient of g(z) as theresultant; and outputting the second lowest coefficient of g(z) dividedby n as the free term of the scaled inverse of the first polynomial v(x)modulo the second polynomial f_(n)(x).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(19) In a further exemplary embodiment of the invention, an apparatusfor computing a resultant and a free term of a scaled inverse of a firstpolynomial v(x) modulo a second polynomial f_(n)(x), the apparatuscomprising: means for receiving the first polynomial v(x) modulo thesecond polynomial f_(n)(x), where the second polynomial is of a formf_(n)(x)=x^(n)±1, where n=2^(k) and k is an integer greater than 0;means for computing lowest two coefficients of a third polynomial g(z)that is a function of the first polynomial and the second polynomial,where

${{g(z)}\overset{def}{=}{\prod\limits_{i = 0}^{n - 1}\left( {{v\left( \rho_{i} \right)} - z} \right)}},$

where ρ₀, ρ₁, . . . , ρ_(n−1) are roots of the second polynomialf_(n)(x) over a field; means for outputting the lowest coefficient ofg(z) as the resultant; and means for outputting the second lowestcoefficient of g(z) divided by n as the free term of the scaled inverseof the first polynomial v(x) modulo the second polynomial f_(n)(x).

An apparatus as in any above, further comprising means for storing thefirst polynomial v(x) modulo the second polynomial f_(n)(x). Anapparatus as in any above, where the means for storing comprises atleast one storage medium, memory or memory medium. An apparatus as inany above, where the means for receiving, the means for computing, themeans for outputting the lowest coefficient of g(z) and the means foroutputting the second lowest coefficient of g(z) comprise at least oneprocessor, at least one processing component, at least one circuit or atleast one integrated circuit. An apparatus as in any above, furthercomprising one or more additional aspects of the exemplary embodimentsof the invention as described herein.

(20) In another exemplary embodiment of the invention, an apparatus forcomputing a resultant and a free term of a scaled inverse of a firstpolynomial v(x) modulo a second polynomial f_(n)(x), the apparatuscomprising: first circuitry (e.g., receiving circuitry, first processingcircuitry) configured to receive the first polynomial v(x) modulo thesecond polynomial f_(n)(x), where the second polynomial is of a formf_(n)(x)=x^(n)±1, where n=2^(k) and k is an integer greater than 0;second circuitry (e.g., computation circuitry, second processingcircuitry) configured to compute lowest two coefficients of a thirdpolynomial g(z) that is a function of the first polynomial and thesecond polynomial, where

${{g(z)}\overset{def}{=}{\prod\limits_{i = 0}^{n - 1}\left( {{v\left( \rho_{i} \right)} - z} \right)}},$

where ρ₀, ρ₁, . . . , ρ_(n−1) are roots of the second polynomialf_(n)(x) over a field; third circuitry (e.g., first output circuitry,third processing circuitry) configured to output the lowest coefficientof g(z) as the resultant; and fourth circuitry (e.g., second outputcircuitry, fourth processing circuitry) configured to output the secondlowest coefficient of g(z) divided by n as the free term of the scaledinverse of the first polynomial v(x) modulo the second polynomialf_(n)(x).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

Building on sections 8 and 9, FIG. 6 shows a table with an example forimplementing various exemplary embodiments of the invention. In FIG. 6,the leftmost column shows the type of data portrayed in that particularrow. The rightmost column shows the maximum index (maximum value of i)for that row's data. The intermediate columns (between the leftmost andrightmost columns) show the data points corresponding to that value of i(see the top row). The rows are roughly arranged in sequential order forperforming an exemplary method, computer program and system as describedherein.

In the example shown in FIG. 6, there is a big set B that has 9 elementsz_(i) (N=9). There is a small set S that has 3 elements s_(j) (n=3) andis a subset of the big set B. There is a bit vector {right arrow over(σ)} that has 9 bits σ_(i) such that σ_(i)=1 if z_(i)εS else σ_(i)=0.There is an encrypted vector {right arrow over (d)} that has 9ciphertexts d_(i) that are each an encryption of the corresponding bitσ_(i). The big set B is partitioned into 3 parts p_(j) with each of the3 parts p_(j) having a plurality of different elements from the big setB. The elements s_(j) of the small set S consist of one element fromeach of the 3 parts p_(j). As shown in FIG. 6, the row for “Part(p_(j))” indicates of which part p_(j) each i-index item is a member.

The provided ciphertext element c is post-processed by multiplying theciphertext element c by all elements of the big set B to obtain anintermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

such that the element y_(i) of the intermediate vector {right arrow over(y)} is computed as y_(i)=c×z_(i). The individual elements y_(i) of theintermediate vector {right arrow over (y)} are represented in binary (asa sequence of bits).

The elements of the intermediate vector {right arrow over (y)} arehomomorphically multiplied by the ciphertexts d_(i) in the encryptedvector {right arrow over (d)} to obtain a ciphertext vector {right arrowover (x)} that has 9 ciphertext elements x_(i) such that {right arrowover (x)}=

x₁, x₂, . . . , x_(N)

. Each ciphertext element x_(i) in the ciphertext vector {right arrowover (x)} is an encryption of the product y_(i)·σ_(i). Since each y_(i)is represented in binary, each x_(i) may comprise one or moreciphertexts, for example, with each ciphertext being an encryption of abit from y_(i) as multiplied by σ_(i). All of the ciphertext elementsx_(i) of the ciphertext vector {right arrow over (x)} arehomomorphically summed to obtain a resulting ciphertext that comprisesan encryption of the at least one bit b. This homomorphic summation isnot a direct addition of ciphertexts.

(21) In a further exemplary embodiment of the invention, and as shown inFIG. 7, a method for homomorphic decryption, comprising: providing(e.g., by an apparatus, by at least one processor, by at least oneprocessing component, by at least one integrated circuit, by hardware) aciphertext comprising a ciphertext element c that is obtained byencrypting at least one bit b using a public key h, where the public keyh and a private key w collectively comprise an encryption key pair suchthat the private key w enables decryption of data that has beenencrypted using the public key h to form a ciphertext, where thereexists a big set B that includes N elements z_(i) such that B={z₁, z₂, .. . , z_(N)}, where there exists a small set S that includes n elementss_(j) such that S={s₁, s₂, . . . , s_(n)}, where the small set S is asubset of the big set B, where n<N, where n is an integer greater thanone, where summing up the elements s_(j) of the small set S yields theprivate key w, where there exists a bit vector {right arrow over (σ)}that includes N bits σ_(i) such that {right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i) (701); post-processing(e.g., by the apparatus) the provided ciphertext element c bymultiplying the provided ciphertext element c by all elements of the bigset B to obtain an intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i) (702); homomorphicallymultiplying (e.g., by the apparatus) the elements y_(i) of theintermediate vector {right arrow over (y)} by the ciphertexts d_(i) inthe encrypted vector {right arrow over (d)} to obtain a ciphertextvector {right arrow over (x)} comprised of ciphertexts, where theciphertext vector {right arrow over (x)} includes N ciphertext elementsx_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·_(i) (703);and homomorphically summing (e.g., by the apparatus) all of theciphertext elements x_(i) of the ciphertext vector {right arrow over(x)} to obtain a resulting ciphertext that comprises an encryption ofthe at least one bit b, where the big set B is partitioned into n partsp_(j) with each of the n parts p_(j) having a plurality of differentelements from the big set B, where the elements s_(j) of the small set Sconsist of one element from each of the n parts p_(j) (704).

A method as in any above, where the private key w comprises at least oneof: an integer, a vector, a matrix and an element in an algebraic ring.A method as in any above, where each of the n parts has N/n differentelements from the big set B. A method as in any above, where theencrypted vector {right arrow over (d)} is represented by n partialencrypted vectors {right arrow over (e)}_(j), one for each part p_(j) ofthe big set B, where for all j the partial encrypted vector {right arrowover (e)}_(j) comprises t_(j) ciphertexts, two of which are encryptionsof 1 and the rest being encryptions of 0. A method as in any above,where for all j the j'th part of the big set B has a size a_(j), wherethe number of ciphertexts t_(j) in the partial encrypted vector {rightarrow over (e)}_(j) satisfies the relation: t_(j)≧┌√{square root over(2a_(j))}┐. A method as in any above, where each ciphertext d_(i) in theencrypted vector {right arrow over (d)} is computed as a function of twociphertexts from one of the partial encrypted vectors {right arrow over(e)}_(j). A method as in any above, where each ciphertext d_(i) in theencrypted vector {right arrow over (d)} is computed as a product of twociphertexts from one of the partial encrypted vectors {right arrow over(e)}_(j). A method as in any above, where each of the n parts p_(j)comprises a geometric progression of elements z_(i) from the big set B.A method as in any above, where each of the n parts p_(j) comprises ageometric progression of elements z_(i) from the big set B.

A computer program comprising machine readable instructions which whenexecuted by an apparatus control it to perform the method as in any oneof the preceding. A method as in any above, implemented as a computerprogram. A method as in any above, implemented as a program ofinstructions stored (e.g., tangibly embodied) on a program storagedevice (e.g., at least one memory, at least one computer-readablemedium) and executable by a computer (e.g., at least one processor). Amethod as in any above, further comprising one or more aspects of theexemplary embodiments of the invention as described further herein.

(22) In another exemplary embodiment of the invention, and as shown inFIG. 7, a computer readable storage medium (e.g., a memory, at least onememory, non-transitory) tangibly embodying a program of instructionsexecutable by a machine (e.g., a processor, at least one processor, acomputer) for performing operations for homomorphic decryption, theoperations comprising: providing a ciphertext comprising a ciphertextelement c that is obtained by encrypting at least one bit b using apublic key h, where the public key h and a private key w collectivelycomprise an encryption key pair such that the private key w enablesdecryption of data that has been encrypted using the public key h toform a ciphertext, where there exists a big set B that includes Nelements z_(i) such that B={z₁, z₂, . . . , z_(N)}, where there exists asmall set S that includes n elements s_(j) such that S={s₁, s₂, . . . ,s_(n)}, where the small set S is a subset of the big set B, where n<N,where n is an integer greater than one, where summing up the elementss_(j) of the small set S yields the private key w, where there exists abit vector {right arrow over (σ)} that includes N bits σ_(i) such that{right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i) (701); post-processingthe provided ciphertext element c by multiplying the provided ciphertextelement c by all elements of the big set B to obtain an intermediatevector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i) (702); homomorphicallymultiplying the elements y_(i) of the intermediate vector {right arrowover (y)} by the ciphertexts d_(i) in the encrypted vector {right arrowover (d)} to obtain a ciphertext vector {right arrow over (x)} comprisedof ciphertexts, where the ciphertext vector {right arrow over (x)}includes N ciphertext elements x_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i)(703); and homomorphically summing all of the ciphertext elements x_(i)of the ciphertext vector {right arrow over (x)} to obtain a resultingciphertext that comprises an encryption of the at least one bit b, wherethe big set B is partitioned into n parts p_(j) with each of the n partsp_(j) having a plurality of different elements from the big set B, wherethe elements s_(j) of the small set S consist of one element from eachof the n parts p_(j) (704).

A computer readable storage medium as in any above, further comprisingone or more additional aspects of the exemplary embodiments of theinvention as described herein.

(23) In a further exemplary embodiment of the invention, an apparatus(e.g., for homomorphic decryption) comprising: at least one storagemedium configured to store a ciphertext comprising a ciphertext elementc that is obtained by encrypting at least one bit b using a public keyh, where the public key h and a private key w collectively comprise anencryption key pair such that the private key w enables decryption ofdata that has been encrypted using the public key h to form aciphertext, where there exists a big set B that includes N elementsz_(i) such that B={z₁, z₂, . . . , z_(N)}, where there exists a smallset S that includes n elements s_(j) such that S={s₁, s₂, . . . ,s_(n)}, where the small set S is a subset of the big set B, where n<N,where n is an integer greater than one, where summing up the elementss_(j) of the small set S yields the private key w, where there exists abit vector {right arrow over (σ)} that includes N bits σ_(i) such that{right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i); and at least oneprocessor configured to post-process the provided ciphertext element cby multiplying the provided ciphertext element c by all elements of thebig set B to obtain an intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i), where the at least oneprocessor is further configured to homomorphically multiply the elementsy_(i) of the intermediate vector {right arrow over (y)} by theciphertexts d_(i) in the encrypted vector {right arrow over (d)} toobtain a ciphertext vector {right arrow over (x)} comprised ofciphertexts, where the ciphertext vector {right arrow over (x)} includesN ciphertext elements x_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i),where the at least one processor is further configured tohomomorphically sum all of the ciphertext elements x_(i) of theciphertext vector {right arrow over (x)} to obtain a resultingciphertext that comprises an encryption of the at least one bit b, wherethe big set B is partitioned into n parts p_(j) with each of the n partsp_(j) having a plurality of different elements from the big set B, wherethe elements s_(j) of the small set S consist of one element from eachof the n parts p_(j).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(24) In another exemplary embodiment of the invention, an apparatus(e.g., for homomorphic decryption) comprising: means for providing aciphertext comprising a ciphertext element c that is obtained byencrypting at least one bit b using a public key h, where the public keyh and a private key w collectively comprise an encryption key pair suchthat the private key w enables decryption of data that has beenencrypted using the public key h to form a ciphertext, where thereexists a big set B that includes N elements z_(i) such that B={z₁, z₂, .. . , z_(N)}, where there exists a small set S that includes n elementss_(j) such that S={s₁, s₂, . . . , s_(n)}, where the small set S is asubset of the big set B, where n<N, where n is an integer greater thanone, where summing up the elements s_(j) of the small set S yields theprivate key w, where there exists a bit vector {right arrow over (σ)}that includes N bits σ_(i) such that {right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i); means forpost-processing the provided ciphertext element c by multiplying theprovided ciphertext element c by all elements of the big set B to obtainan intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i); means for homomorphicallymultiplying the elements y_(i) of the intermediate vector {right arrowover (y)} by the ciphertexts d_(i) in the encrypted vector {right arrowover (d)} to obtain a ciphertext vector {right arrow over (x)} comprisedof ciphertexts, where the ciphertext vector {right arrow over (x)}includes N ciphertext elements x_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i); andmeans for homomorphically summing all of the ciphertext elements x_(i)of the ciphertext vector {right arrow over (x)} to obtain a resultingciphertext that comprises an encryption of the at least one bit b, wherethe big set B is partitioned into n parts p_(j) with each of the n partsp_(j) having a plurality of different elements from the big set B, wherethe elements s_(j) of the small set S consist of one element from eachof the n parts p_(j).

An apparatus as in any above, further comprising means for storing atleast one of the ciphertext, the at least one bit, the public key, theprivate key, the big set, the small set, the bit vector, the encryptedvector, the intermediate vector, the ciphertext vector and the resultingciphertext. An apparatus as in any above, where the means for storingcomprises at least one storage medium, memory or memory medium. Anapparatus as in any above, where the means for providing, the means forpost-processing, the means for homomorphically multiplying and the meansfor homomorphically summing comprise at least one processor, at leastone processing component, at least one circuit or at least oneintegrated circuit. An apparatus as in any above, further comprising oneor more additional aspects of the exemplary embodiments of the inventionas described herein.

(25) In a further exemplary embodiment of the invention, an apparatus(e.g., for homomorphic decryption) comprising: first circuitry (e.g.,input circuitry, first processing circuitry) configured to provide aciphertext comprising a ciphertext element c that is obtained byencrypting at least one bit b using a public key h, where the public keyh and a private key w collectively comprise an encryption key pair suchthat the private key w enables decryption of data that has beenencrypted using the public key h to form a ciphertext, where thereexists a big set B that includes N elements z_(i) such that B={z₁, z₂, .. . , z_(N)}, where there exists a small set S that includes n elementss_(j) such that S={s₁, s₂, . . . , s_(n)}, where the small set S is asubset of the big set B, where n<N, where n is an integer greater thanone, where summing up the elements s_(j) of the small set S yields theprivate key w, where there exists a bit vector {right arrow over (σ)}that includes N bits σ_(i) such that {right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ₁=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i); second circuitry(e.g., post-processing circuitry, second processing circuitry)configured to post-process the provided ciphertext element c bymultiplying the provided ciphertext element c by all elements of the bigset B to obtain an intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i); third circuitry (e.g.,homomorphic multiplication circuitry, third processing circuitry)configured to homomorphically multiply the elements y_(i) of theintermediate vector {right arrow over (y)} by the ciphertexts d_(i) inthe encrypted vector {right arrow over (d)} to obtain a ciphertextvector {right arrow over (x)} comprised of ciphertexts, where theciphertext vector {right arrow over (x)} includes N ciphertext elementsx_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i); andfourth circuitry (e.g., homorphic summation circuitry, fourth processingcircuitry) configured to homomorphically sum all of the ciphertextelements x_(i) of the ciphertext vector {right arrow over (x)} to obtaina resulting ciphertext that comprises an encryption of the at least onebit b, where the big set B is partitioned into n parts p_(j) with eachof the n parts p_(j) having a plurality of different elements from thebig set B, where the elements s_(j) of the small set S consist of oneelement from each of the n parts p_(j).

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(26) In another exemplary embodiment of the invention, and as shown inFIG. 8, a method for homomorphic decryption, comprising: providing(e.g., by an apparatus, by at least one processor, by at least oneprocessing component, by at least one integrated circuit, by hardware) aciphertext comprising a ciphertext element c that is obtained byencrypting at least one bit b using a public key h, where the public keyh and a private key w collectively comprise an encryption key pair suchthat the private key w enables decryption of data that has beenencrypted using the public key h to form a ciphertext, where thereexists a big set B that includes N elements z_(i) such that B={z₁, z₂, .. . , z_(N)}, where there exists a small set S that includes n elementss_(j) such that S={s₁, s₂, . . . , s_(n)}, where the small set S is asubset of the big set B, where n<N, where n is an integer greater thanone, where summing up the elements s_(j) of the small set S yields theprivate key w, where there exists a bit vector {right arrow over (σ)}that includes N bits σ_(i) such that {right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i) (801); post-processing(e.g., by the apparatus) the provided ciphertext element c bymultiplying the provided ciphertext element c by all elements of the bigset B to obtain an intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i) (802); homomorphicallymultiplying (e.g., by the apparatus) the elements y_(i) of theintermediate vector {right arrow over (y)} by the ciphertexts d_(i) inthe encrypted vector {right arrow over (d)} to obtain a ciphertextvector {right arrow over (x)} comprised of ciphertexts, where theciphertext vector {right arrow over (x)} includes N ciphertext elementsx_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i)(803); and homomorphically summing (e.g., by the apparatus) all of theciphertext elements x_(i) of the ciphertext vector {right arrow over(x)} to obtain a resulting ciphertext that comprises an encryption ofthe at least one bit b, where the big set B is comprised of m geometricprogressions {right arrow over (G_(k))}=

g_(l)

, where each geometric progression {right arrow over (G_(k))} comprisesa plurality of different elements z_(i) from the big set B, where m isan integer greater than zero, where for each geometric progression{right arrow over (G_(k))} a ratio of successive elements g_(l)/g_(l−1)is the same for all l (804).

A method as in any above, where the private key w comprises at least oneof: an integer, a vector, a matrix and an element in an algebraic ring.A method as in any above, where each of the n parts has N/n differentelements from the big set B. A method as in any above, where theencrypted vector {right arrow over (d)} is represented by n partialencrypted vectors {right arrow over (e)}_(j), one for each part p_(j) ofthe big set B, where for all j the partial encrypted vector {right arrowover (e)}_(j) comprises t_(j) ciphertexts, two of which are encryptionsof 1 and the rest being encryptions of 0. A method as in any above,where each of the n parts p_(j) comprises a geometric progression ofelements z_(i) from the big set B.

A computer program comprising machine readable instructions which whenexecuted by an apparatus control it to perform the method as in any oneof the preceding. A method as in any above, implemented as a computerprogram. A method as in any above, implemented as a program ofinstructions stored (e.g., tangibly embodied) on a program storagedevice (e.g., at least one memory, at least one computer-readablemedium) and executable by a computer (e.g., at least one processor). Amethod as in any above, further comprising one or more aspects of theexemplary embodiments of the invention as described further herein.

(27) In a further exemplary embodiment of the invention, and as shown inFIG. 8, a computer readable storage medium (e.g., a memory, at least onememory, non-transitory) tangibly embodying a program of instructionsexecutable by a machine (e.g., a processor, at least one processor, acomputer) for performing operations for homomorphic decryption, theoperations comprising providing a ciphertext comprising a ciphertextelement c that is obtained by encrypting at least one bit b using apublic key h, where the public key h and a private key w collectivelycomprise an encryption key pair such that the private key w enablesdecryption of data that has been encrypted using the public key h toform a ciphertext, where there exists a big set B that includes Nelements z_(i) such that B={z₁, z₂, . . . , z_(N)}, where there exists asmall set S that includes n elements s_(j) such that S={s₁, s₂, . . . ,s_(n)}, where the small set S is a subset of the big set B, where n<N,where n is an integer greater than one, where summing up the elementss_(j) of the small set S yields the private key w, where there exists abit vector {right arrow over (σ)} that includes N bits σ_(i) such that{right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i) (801); post-processingthe provided ciphertext element c by multiplying the provided ciphertextelement c by all elements of the big set B to obtain an intermediatevector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i) (802); homomorphicallymultiplying the elements y_(i) of the intermediate vector {right arrowover (y)} by the ciphertexts d_(i) in the encrypted vector {right arrowover (d)} to obtain a ciphertext vector {right arrow over (x)} comprisedof ciphertexts, where the ciphertext vector {right arrow over (x)}includes N ciphertext elements x_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i)(803); and homomorphically summing all of the ciphertext elements x_(i)of the ciphertext vector {right arrow over (x)} to obtain a resultingciphertext that comprises an encryption of the at least one bit b, wherethe big set B is comprised of m geometric progressions {right arrow over(G_(k))}=

g_(l)

, where each geometric progression {right arrow over (G_(k))} comprisesa plurality of different elements z_(i) from the big set B, where m isan integer greater than zero, where for each geometric progression{right arrow over (G_(k))} a ratio of successive elements g_(l)/g_(l−1)is the same for all l (804).

A computer readable storage medium as in any above, further comprisingone or more additional aspects of the exemplary embodiments of theinvention as described herein.

(28) In another exemplary embodiment of the invention, an apparatus(e.g., for homomorphic decryption) comprising: at least one storagemedium configured to store a ciphertext comprising a ciphertext elementc that is obtained by encrypting at least one bit b using a public keyh, where the public key h and a private key w collectively comprise anencryption key pair such that the private key w enables decryption ofdata that has been encrypted using the public key h to form aciphertext, where there exists a big set B that includes N elementsz_(i) such that B={z₁, z₂, . . . , z_(N)}, where there exists a smallset S that includes n elements s_(j) such that S={s₁, s₂, . . . ,s_(n)}, where the small set S is a subset of the big set B, where n<N,where n is an integer greater than one, where summing up the elementss_(j) of the small set S yields the private key w, where there exists abit vector {right arrow over (σ)} that includes N bits σ_(i) such that{right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i); and at least oneprocessor configured to post-process the provided ciphertext element cby multiplying the provided ciphertext element c by all elements of thebig set B to obtain an intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i), where the at least oneprocessor is further configured to homomorphically multiply the elementsy_(i) of the intermediate vector {right arrow over (y)} by theciphertexts d_(i) in the encrypted vector {right arrow over (d)} toobtain a ciphertext vector {right arrow over (x)} comprised ofciphertexts, where the ciphertext vector {right arrow over (x)} includesN ciphertext elements x_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i),where the at least one processor is further configured tohomomorphically sum all of the ciphertext elements x_(i) of theciphertext vector {right arrow over (x)} to obtain a resultingciphertext that comprises an encryption of the at least one bit b, wherethe big set B is comprised of m geometric progressions {right arrow over(G_(k))}=

g_(l)

, where each geometric progression {right arrow over (G_(k))} comprisesa plurality of different elements z_(i) from the big set B, where m isan integer greater than zero, where for each geometric progression{right arrow over (G_(k))} a ratio of successive elements g_(l)/g_(l−1)is the same for all l.

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

(29) In a further exemplary embodiment of the invention, an apparatus(e.g., for homomorphic decryption) comprising: means for providing aciphertext comprising a ciphertext element c that is obtained byencrypting at least one bit b using a public key h, where the public keyh and a private key w collectively comprise an encryption key pair suchthat the private key w enables decryption of data that has beenencrypted using the public key h to form a ciphertext, where thereexists a big set B that includes N elements z_(i) such that B={z₁, z₂, .. . , z_(N)}, where there exists a small set S that includes n elementss_(j) such that S={s₁, s₂, . . . , s_(n)}, where the small set S is asubset of the big set B, where n<N, where n is an integer greater thanone, where summing up the elements s_(j) of the small set S yields theprivate key w, where there exists a bit vector {right arrow over (σ)}that includes N bits σ_(i) such that {right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i); means forpost-processing the provided ciphertext element c by multiplying theprovided ciphertext element c by all elements of the big set B to obtainan intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i); means for homomorphicallymultiplying the elements y_(i) of the intermediate vector {right arrowover (y)} by the ciphertexts d_(i) in the encrypted vector {right arrowover (d)} to obtain a ciphertext vector {right arrow over (x)} comprisedof ciphertexts, where the ciphertext vector {right arrow over (x)}includes N ciphertext elements x_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i); andmeans for homomorphically summing all of the ciphertext elements x_(i)of the ciphertext vector {right arrow over (x)} to obtain a resultingciphertext that comprises an encryption of the at least one bit b, wherethe big set B is comprised of m geometric progressions {right arrow over(G_(k))}=

g_(l)

, where each geometric progression {right arrow over (G_(k))} comprisesa plurality of different elements z_(i) from the big set B, where m isan integer greater than zero, where for each geometric progression{right arrow over (G_(k))} a ratio of successive elements g_(l)/g_(l−1)is the same for all l.

An apparatus as in any above, further comprising means for storing atleast one of the ciphertext, the at least one bit, the public key, theprivate key, the big set, the small set, the bit vector, the encryptedvector, the intermediate vector, the ciphertext vector and the resultingciphertext. An apparatus as in any above, where the means for storingcomprises at least one storage medium, memory or memory medium. Anapparatus as in any above, where the means for providing, the means forpost-processing, the means for homomorphically multiplying and the meansfor homomorphically summing comprise at least one processor, at leastone processing component, at least one circuit or at least oneintegrated circuit. An apparatus as in any above, further comprising oneor more additional aspects of the exemplary embodiments of the inventionas described herein.

(30) In another exemplary embodiment of the invention, an apparatus(e.g., for homomorphic decryption) comprising: first circuitry (e.g.,input circuitry, first processing circuitry) configured to provide aciphertext comprising a ciphertext element c that is obtained byencrypting at least one bit b using a public key h, where the public keyh and a private key w collectively comprise an encryption key pair suchthat the private key w enables decryption of data that has beenencrypted using the public key h to form a ciphertext, where thereexists a big set B that includes N elements z_(i) such that B={z₁, z₂, .. . , z_(N)}, where there exists a small set S that includes n elementss_(j) such that S={s₁, s₂, . . . , s_(n)}, where the small set S is asubset of the big set B, where n<N, where n is an integer greater thanone, where summing up the elements s_(j) of the small set S yields theprivate key w, where there exists a bit vector {right arrow over (σ)}that includes N bits σ_(i) such that {right arrow over (σ)}=

σ₁, σ₂, . . . , σ_(N)

, where for all i the bit σ_(i)=1 if z_(i)εS else the bit σ_(i)=0, wherethere exists an encrypted vector {right arrow over (d)} that includes Nciphertexts d_(i) such that {right arrow over (d)}=

d₁, d₂, . . . , d_(N)

, where for all i the ciphertext d_(i) of the encrypted vector {rightarrow over (d)} is an encryption of the bit σ_(i); second circuitry(e.g., post-processing circuitry, second processing circuitry)configured to post-process the provided ciphertext element c bymultiplying the provided ciphertext element c by all elements of the bigset B to obtain an intermediate vector {right arrow over (y)}=

y₁, y₂, . . . , y_(N)

, where for all i the element y_(i) of the intermediate vector {rightarrow over (y)} is computed as y_(i)=c×z_(i); third circuitry (e.g.,homomorphic multiplication circuitry, third processing circuitry)configured to homomorphically multiply the elements y_(i) of theintermediate vector {right arrow over (y)} by the ciphertexts d_(i) inthe encrypted vector {right arrow over (d)} to obtain a ciphertextvector {right arrow over (x)} comprised of ciphertexts, where theciphertext vector {right arrow over (x)} includes N ciphertext elementsx_(i) such that {right arrow over (x)}=

x₁, x₂, . . . , x_(N)

, where for all i the ciphertext element x_(i) in the ciphertext vector{right arrow over (x)} is an encryption of the product y_(i)·σ_(i); andfourth circuitry (e.g., homorphic summation circuitry, fourth processingcircuitry) configured to homomorphically sum all of the ciphertextelements x_(i) of the ciphertext vector {right arrow over (x)} to obtaina resulting ciphertext that comprises an encryption of the at least onebit b, where the big set B is comprised of m geometric progressions{right arrow over (G_(k))}=

g_(l)

, where each geometric progression {right arrow over (G_(k))} comprisesa plurality of different elements z_(i) from the big set B, where m isan integer greater than zero, where for each geometric progression{right arrow over (G_(k))} a ratio of successive elements g_(l)/g_(l−1)is the same for all l.

An apparatus as in any above, further comprising one or more additionalaspects of the exemplary embodiments of the invention as describedherein.

The exemplary embodiments of the invention, as discussed herein and asparticularly described with respect to exemplary methods, may beimplemented in conjunction with a program storage device (e.g., at leastone memory) readable by a machine, tangibly embodying a program ofinstructions (e.g., a program or computer program) executable by themachine for performing operations. The operations comprise steps ofutilizing the exemplary embodiments or steps of the method.

The blocks shown in FIGS. 2-5, 7 and 8 further may be considered tocorrespond to one or more functions and/or operations that are performedby one or more components, circuits, chips, apparatus, processors,computer programs and/or function blocks. Any and/or all of the abovemay be implemented in any practicable solution or arrangement thatenables operation in accordance with the exemplary embodiments of theinvention as described herein.

In addition, the arrangement of the blocks depicted in FIGS. 2-5, 7 and8 should be considered merely exemplary and non-limiting. It should beappreciated that the blocks shown in FIGS. 2-5, 7 and 8 may correspondto one or more functions and/or operations that may be performed in anyorder (e.g., any suitable, practicable and/or feasible order) and/orconcurrently (e.g., as suitable, practicable and/or feasible) so as toimplement one or more of the exemplary embodiments of the invention. Inaddition, one or more additional functions, operations and/or steps maybe utilized in conjunction with those shown in FIGS. 2-5, 7 and 8 so asto implement one or more further exemplary embodiments of the invention.

That is, the exemplary embodiments of the invention shown in FIGS. 2-5,7 and 8 may be utilized, implemented or practiced in conjunction withone or more further aspects in any combination (e.g., any combinationthat is suitable, practicable and/or feasible) and are not limited onlyto the steps, blocks, operations and/or functions shown in FIGS. 2-5, 7and 8.

Any use of the terms “connected,” “coupled” or variants thereof shouldbe interpreted to indicate any such connection or coupling, direct orindirect, between the identified elements. As a non-limiting example,one or more intermediate elements may be present between the “coupled”elements. The connection or coupling between the identified elements maybe, as non-limiting examples, physical, electrical, magnetic, logical orany suitable combination thereof in accordance with the describedexemplary embodiments. As non-limiting examples, the connection orcoupling may comprise one or more printed electrical connections, wires,cables, mediums or any suitable combination thereof.

The term “geometric progression” or “geometric sequence” is afforded itsconventional meaning for a sequence of numbers where each term after thefirst is found by multiplying the previous term by a fixed non-zeronumber, sometimes called the common ratio r. For example, the numbersx_(i) in a geometric progression will satisfy the following relationsfor a ratio r:

x_(i) = rx_(i − 1) $r = \frac{x_{i}}{x_{i - 1}}$

The homomorphic operations (e.g., multiplication, summation) describedor referred to herein are afforded their conventional meaning ofperforming the operation(s) on encrypted data without requiring thedecryption of said data and yielding a same result (e.g., barringnoise). Non-limiting examples of suitable techniques for implementingthese homomorphic operations are described by Gentry in [3].

It should be appreciated that the references herein to encryption and/ordecryption may entail the usage of one or more encryption schemes,techniques or methods as known to one of ordinary skill in the art. Asan example, different key sizes are available for the encryption scheme(e.g., 512, 1024, 2048, 4096, 8192, 32768, as measured in bits). As afurther example, different hash functions may be used for theencryption/decryption, such as MD-4, MD-5, SHA-1 or SHA-2, asnon-limiting examples.

As will be appreciated by one skilled in the art, exemplary embodimentsof the present invention may be embodied as a system, method or computerprogram product. Accordingly, exemplary embodiments of the presentinvention may take the form of an entirely hardware embodiment, anentirely software embodiment (including firmware, resident software,micro-code, etc.) or an embodiment combining software and hardwareaspects that may all generally be referred to herein as a “circuit,”“module” or “system.” Furthermore, exemplary embodiments of the presentinvention may take the form of a computer program product embodied inone or more program storage device(s) or computer readable medium(s)having computer readable program code embodied thereon.

Any combination of one or more program storage device(s) or computerreadable medium(s) may be utilized. The computer readable medium may bea computer readable signal medium or a computer readable storage medium.As non-limiting examples, a computer readable storage medium maycomprise one or more of: an electronic, magnetic, optical,electromagnetic, infrared, or semiconductor system, apparatus, ordevice, or any suitable combination thereof. More specific examples (anon-exhaustive list) of the computer readable storage medium wouldinclude the following: an electrical connection having one or morewires, a portable computer diskette, a hard disk, a random access memory(RAM), a read-only memory (ROM), an erasable programmable read-onlymemory (EPROM or Flash memory), an optical fiber, a portable compactdisc read-only memory (CD-ROM), an optical storage device, a magneticstorage device, or any suitable combination of the foregoing. In thecontext of this document, a computer readable storage medium may be anytangible medium that can contain or store a program for use by or inconnection with an instruction execution system, apparatus, or device(e.g., one or more processors).

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider (ISP)).

Exemplary embodiments of the present invention are described herein withreference to flowchart illustrations and/or block diagrams of methods,apparatus (systems) and computer program products according to exemplaryembodiments of the invention. It should be understood that each block ofthe flowchart illustrations and/or block diagrams, and combinations ofblocks in the flowchart illustrations and/or block diagrams, can beimplemented by computer program instructions. These computer programinstructions may be provided to a processor of a general purposecomputer, special purpose computer, or other programmable dataprocessing apparatus to produce a machine, such that the instructions,which execute via at least one processor of the computer or otherprogrammable data processing apparatus, create means for implementingthe functions/acts specified in the flowchart and/or block diagram blockor blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other device to cause aseries of operational steps to be performed on the computer, otherprogrammable apparatus or other device to produce a computer implementedprocess such that the instructions which execute on the computer orother programmable apparatus provide processes for implementing thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality and operation of possible implementations ofsystems, methods and computer program products according to variousexemplary embodiments of the present invention. In this regard, eachblock in the flowchart or block diagrams may represent a module,segment, or portion of code, which comprises one or more executableinstructions for implementing the specified logical function(s). Itshould also be noted that, in some alternative implementations, thefunctions noted in the block may occur out of the order noted in thefigures. For example, two blocks shown in succession may, in fact, beexecuted substantially concurrently, or the blocks may sometimes beexecuted in the reverse order, depending upon the functionalityinvolved. It will also be noted that each block of the block diagramsand/or flowchart illustration, and possibly combinations of blocks inthe block diagrams and/or flowchart illustration, can be implemented byspecial purpose hardware-based systems that perform the specifiedfunctions or acts, or combinations of special purpose hardware andsoftware (e.g., computer instructions).

Generally, various exemplary embodiments of the invention can beimplemented in different mediums, such as software, hardware, logic,special purpose circuits or any combination thereof. As a non-limitingexample, some aspects may be implemented in software which may be run ona computing device, while other aspects may be implemented in hardware.

The foregoing description has provided by way of exemplary andnon-limiting examples a full and informative description of the bestmethod and apparatus presently contemplated by the inventors forcarrying out the invention. However, various modifications andadaptations may become apparent to those skilled in the relevant arts inview of the foregoing description, when read in conjunction with theaccompanying drawings and the appended claims. However, all such andsimilar modifications will still fall within the scope of the teachingsof the exemplary embodiments of the invention.

Furthermore, some of the features of the preferred embodiments of thisinvention could be used to advantage without the corresponding use ofother features. As such, the foregoing description should be consideredas merely illustrative of the principles of the invention, and not inlimitation thereof.

1. A method for evaluating at a point r one or more polynomials p₁(x), .. . , p_(l)(x) of maximum degree up to n−1, where for every i thepolynomial p_(i)(x) has a degree of exactly t_(i)−1, the methodcomprising: partitioning each polynomial p_(i)(x) into a bottom halfp_(i) ^(bot)(x) consisting of bottom terms with lowest s_(i)coefficients and a top half p_(i) ^(top)(x) consisting of top terms withremaining t_(i)−s_(i) coefficients, where n and l are integers greaterthan zero, where for every i, t_(i) and s_(i) are integers greater thanzero; recursively partitioning the bottom half p_(i) ^(bot)(x) and thetop half p_(i) ^(top)(x) of each polynomial p_(i)(x) to obtain furtherterms having a lower degree than previous terms, where the recursivepartitioning is performed until at least one condition is met at whichpoint the recursive partitioning yields a plurality of partitionedterms; evaluating the bottom half p_(i) ^(bot)(x) and the top half p_(i)^(top)(x) at the point r for each polynomial p_(i)(x) by evaluating theplurality of partitioned terms at the point r and iteratively combiningthe evaluated partitioned terms; and evaluating each polynomial p_(i)(x)at the point r by setting p_(i)(r)=r^(s) ^(i) p_(i) ^(top)(r)+p_(i)^(bot)(r).
 2. The method of claim 1, where recursively partitioning thebottom half p_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) of eachpolynomial p_(i)(x) comprises iteratively doubling a number of termswhile reducing a degree of the terms by half.
 3. The method as in claim1, where the at least one condition is with respect to a current numberof polynomial terms k and a current maximal degree m of the polynomialterms, where powers of r are expressed as r, r², r³, . . . , r^(m),where in response to the at least one condition being met all the powersof r up to the current maximal degree m of the polynomial terms arecomputed and all of the polynomial terms are evaluated by adding up allof the powers of r multiplied by their respective coefficients:p_(i)(r)=Σ_(r=0) ^(r=m)p_(ij)r^(j), where for every i and j, p_(ij) isthe coefficient of r^(j) in the polynomial p_(i)(x).
 4. The method as inclaim 1, where the at least one condition is with respect to a currentnumber of polynomial terms k and a current maximal degree m of thepolynomial terms, where the at least one condition comprises the currentnumber of polynomial terms k being larger than half of the currentmaximal degree m: $k > {\frac{m}{2}.}$
 5. The method as in claim 1,where for every i, ${s_{i} = \frac{n}{2}},$ rounded to an integer. 6.The method as in claim 1, where iteratively combining the evaluatedpartitioned terms is performed until evaluations of the bottom halfp_(i) ^(bot)(x) and the top half p_(i) ^(top)(x) at the point r areobtained.
 7. The method as in claim 1, where the method is utilized inconjunction with encryption of at least one bit.
 8. The method as inclaim 1, further comprising: obtaining one or more ciphertext results bymultiplying the evaluation of each of the one or more polynomials p₁(x),. . . , p_(l)(x) at the point r by two and for every i adding a bitb_(i).
 9. A computer program comprising machine readable instructionswhich when executed by an apparatus control it to perform the method asin claim
 1. 10. A method for evaluating at a point r one or morepolynomials p₁(x), . . . , p_(l)(x) of maximum degree up to n−1, wherefor every i the polynomial p_(i)(x) has a degree of exactly t_(i)−1, themethod comprising: partitioning each polynomial p_(i)(x) into a_(i)parts p_(i) ⁽¹⁾(x), p_(i) ⁽²)(x), . . . , p_(i) ^((a) ^(i) ⁾(x), wherefor each i and j the part p_(i) ^((j))(x) consists of a differentsequential portion of the t_(i) coefficients of the polynomial p_(i)(x),where n is an integer greater than zero, where for every i, a_(i), andt_(i) are integers greater than zero; recursively partitioning each partp_(i) ^((j))(x) of each polynomial p_(i)(x) to obtain further termshaving a lower degree than previous terms, where the recursivepartitioning is performed until at least one condition is met at whichpoint the recursive partitioning yields a plurality of partitionedterms; evaluating each part p_(i) ^((j))(x) at the point r for eachpolynomial p_(i)(x) by evaluating the plurality of partitioned terms atthe point r and iteratively combining the evaluated partitioned terms;and evaluating each polynomial p_(i)(x) at the point r by settingp_(i)(r)=Σ_(j=1) ^(ai)r_(j) ^(y) ^(ij) p_(i) ^((j))(r), where for everyi, y_(ij) is a total number of coefficients in all of the parts from 1to j−1: p_(i) ⁽¹⁾(x), p_(i) ⁽²)(x), . . . , p_(i) ^((j−1))(x).
 11. Themethod of claim 10, where a_(i)=2 for all i.
 12. The method of claim 10,where a_(i)>2 for some i.
 13. The method as in claim 10, whererecursively partitioning each part p_(i) ^((j))(x) of each polynomialp_(i)(x) comprises iteratively doubling a number of terms while reducinga degree of the terms by half.
 14. The method as in claim 10, where theat least one condition is with respect to a current number of polynomialterms k and a current maximal degree m of the polynomial terms, wherepowers of r are expressed as r, r², r³, . . . , r^(m), where in responseto the at least one condition being met all the powers of r up to thecurrent maximal degree m of the polynomial terms are computed and all ofthe polynomial terms are evaluated by adding up all of the powers of rmultiplied by their respective coefficients: p_(i)(r)=Σ_(r=0)^(r=m)p_(ij)r^(j), where for every i and j, p_(ij) is the coefficient ofr^(j) in the polynomial p_(i)(x).
 15. The method as in claim 10, wherethe at least one condition is with respect to a current number ofpolynomial terms k and a current maximal degree m of the polynomialterms, where the at least one condition comprises the current number ofpolynomial terms k being larger than half of the current maximal degreem: $k > {\frac{m}{2}.}$
 16. The method as in claim 10, where iterativelycombining the evaluated partitioned terms comprises iterativelycombining lowest powers of the evaluated partitioned terms to obtainhigher power terms.
 17. The method as in claim 10, where iterativelycombining the evaluated partitioned terms is performed until evaluationsof each part p_(i) ^((j))(x) at the point r are obtained.
 18. The methodas in claim 10, further comprising: obtaining at least one ciphertextresult by multiplying the evaluation of each polynomial p_(i)(x) at thepoint r by two and for every i adding a bit b_(i).
 19. A computerprogram comprising machine readable instructions which when executed byan apparatus control it to perform the method as in claim
 10. 20. Amethod for evaluating at a point one or more polynomials, comprising:starting with a current number of current polynomials having a currentmaximal degree, recursively partitioning the current polynomials todouble the current number of current polynomials while reducing thecurrent maximal degree of the current polynomials by half; in responseto the current maximal degree meeting at least one condition, evaluatingthe current polynomials to obtain a plurality of partial results; andobtaining a total evaluation for the one or more polynomials at thepoint by recombining the plurality of partial results into polynomialsin reverse order from the recursive partitioning.
 21. The method ofclaim 20, where recursively partitioning the current polynomialscomprises iteratively doubling a number of polynomials while reducing amaximum degree of the polynomials by half.
 22. The method as in claim20, where the at least one condition is with respect to the currentnumber of current polynomials and the current maximal degree.
 23. Themethod as in claim 20, where the at least one condition is with respectto the current number of current polynomials and the current maximaldegree, where the at least one condition comprises the current number ofcurrent polynomials being larger than half of the current maximaldegree.
 24. A computer program comprising machine readable instructionswhich when executed by an apparatus control it to perform the method asin claim 20.